CVE-2021-3427: XSS
The Deluge Web-UI is vulnerable to cross-site scripting through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
Other sources
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/delugeto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3427?
The severity of CVE-2021-3427 is classified as medium due to its potential to allow cross-site scripting via malicious torrent files.
How do I fix CVE-2021-3427?
To fix CVE-2021-3427, upgrade to Deluge version 2.1.0 or later, which includes safeguards against this vulnerability.
Who is affected by CVE-2021-3427?
CVE-2021-3427 affects users of Deluge versions prior to 2.1.0 who use the Web-UI to manage torrent files.
What kind of attack can be executed using CVE-2021-3427?
An attacker can execute arbitrary JavaScript code in the context of the Web-UI through a crafted torrent file.
Is CVE-2021-3427 specific to certain platforms?
CVE-2021-3427 is not platform-specific but affects any system running the vulnerable versions of Deluge regardless of the operating system.