CVE-2021-39268: XSS
Published Aug 18, 2021
·Updated
Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the cleanfileoutput protection mechanism can be bypassed.
Affected Software
1 affected component
SalesAgility SuiteCRM<7.11.19
Event History
Aug 18, 2021
CVE Published
via MITRE·12:29 AM
Data Sourced
via MITRE·12:29 AM
Description
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of the persistent cross-site scripting (XSS) vulnerability in SuiteCRM?
The vulnerability ID is CVE-2021-39268.
2
What is the severity of CVE-2021-39268?
The severity of CVE-2021-39268 is medium with a CVSS score of 6.1.
3
What is the affected software version of CVE-2021-39268?
The affected software version is SuiteCRM before 7.11.19.
4
How does CVE-2021-39268 work?
CVE-2021-39268 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files by bypassing the clean_file_output protection mechanism.
5
How can the persistent cross-site scripting (XSS) vulnerability in SuiteCRM be fixed?
To fix the persistent cross-site scripting (XSS) vulnerability in SuiteCRM, update to version 7.11.19 or later as recommended by the vendor SalesAgility.