CVE-2021-27887: Stored XSS vulnerability in Ellipse APM
First published: Mon Jun 14 2021(Updated: )
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids Ellipse APM 5.3 version 5.3.0.1 and prior versions; 5.2 version 5.2.0.3 and prior versions; 5.1 version 5.1.0.6 and prior versions.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hitachiabb-powergrids Ellipse Asset Performance Management | >=5.1.0.0<=5.1.0.6 | |
| Hitachiabb-powergrids Ellipse Asset Performance Management | >=5.2.0.0<=5.2.0.3 | |
| Hitachiabb-powergrids Ellipse Asset Performance Management | >=5.3.0.0<=5.3.0.1 |
Remedy
The problem is corrected in the following product versions: Ellipse APM versions 5.3.0.2, 5.2.0.4, and 5.1.0.7. Hitachi ABB Power Grids recommends that customers apply the update at the earliest convenience.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-27887?
The severity of CVE-2021-27887 is medium, with a severity value of 5.4.
How does CVE-2021-27887 affect Ellipse APM?
CVE-2021-27887 affects versions of Ellipse APM 5.1.0.0 to 5.1.0.6, 5.2.0.0 to 5.2.0.3, and 5.3.0.0 to 5.3.0.1.
What is the vulnerability type of CVE-2021-27887?
CVE-2021-27887 is a Cross-site Scripting (XSS) vulnerability.
How can an attacker exploit CVE-2021-27887?
An attacker can exploit CVE-2021-27887 by injecting malicious data into the main dashboard of Ellipse APM, which can then be executed in a victim's browser.
Is there a fix available for CVE-2021-27887?
Information on how to fix CVE-2021-27887 can be found in the provided reference link.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/weakness
- agent/title
- agent/severity
- agent/last-modified-date
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/tags
- vendor/hitachiabb-powergrids
- canonical/hitachiabb-powergrids ellipse asset performance management
- version/hitachiabb-powergrids ellipse asset performance management/5.1.0.0
- version/hitachiabb-powergrids ellipse asset performance management/5.1.0.6
- version/hitachiabb-powergrids ellipse asset performance management/5.2.0.0
- version/hitachiabb-powergrids ellipse asset performance management/5.2.0.3
- version/hitachiabb-powergrids ellipse asset performance management/5.3.0.0
- version/hitachiabb-powergrids ellipse asset performance management/5.3.0.1