CVE-2021-20667: XSS
First published: Wed Mar 10 2021(Updated: )
Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WESEEK GROWI | <=4.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-20667?
CVE-2021-20667 is a stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier.
How does CVE-2021-20667 impact GROWI software?
CVE-2021-20667 allows remote authenticated attackers to inject an arbitrary script via specially crafted content.
What is the severity level of CVE-2021-20667?
CVE-2021-20667 has a severity level of 5.4, classified as medium.
How can I prevent the Stored XSS in GROWI versions v4.2.2 and earlier?
To prevent the Stored XSS vulnerability in GROWI versions v4.2.2 and earlier, update the CSP (Content Security Policy) configuration to adequately mitigate the risk.
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/weseek
- canonical/weseek growi
- version/weseek growi/4.2.2