CVE-2021-41791
Last modified
CVE-2021-41791 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features).. EPSS estimates a 0.53% chance of exploitation in the next 30 days.
Description
An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features).
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Alfresco | Community Share | <= 7.0 |
| Alfresco | Share | >= 5.0.0.0, <= 5.2.7.11 |
| Alfresco | Share | >= 6.0.1.0, <= 6.0.1.2 |
| Alfresco | Share | >= 6.0.2.0, <= 6.2.2.4 |
| Alfresco | Share | >= 6.1.1.0, <= 6.1.1.2 |
| Alfresco | Share | 7.0 |
| Alfresco | Share | 7.0.0.1 |
| Alfresco | Share | 7.0.0.2 |
| Alfresco | Share | 7.0.1 |
References
- https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.mdThird Party Advisory
- https://www.themissinglink.com.au/Third Party Advisory
- https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.mdThird Party Advisory
- https://www.themissinglink.com.au/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-41791?
How severe is CVE-2021-41791?
How do I fix CVE-2021-41791?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-41784Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and…7.8
- CVE-2021-41785Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and…7.8
- CVE-2021-41788MediaTek microchips, as used in NETGEAR devices through 2021…7.5
- CVE-2021-41789In wifi driver, there is a possible system crash due to a mi…6.5
- CVE-2021-4179livehelperchat is vulnerable to Improper Neutralization of I…5.4
- CVE-2021-41790An issue was discovered in Hyland org.alfresco:alfresco-cont…8.8
- CVE-2021-41792An issue was discovered in Hyland org.alfresco:alfresco-cont…5.3
- CVE-2021-41794ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriatel…7.5
- CVE-2021-41795The Safari app extension bundled with 1Password for Mac 7.7.…6.5
- CVE-2021-41796Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-41797Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-41798MediaWiki before 1.36.2 allows XSS. Month related MediaWiki …6.1
Are you affected by CVE-2021-41791?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST