CVE-2021-3977: Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja
Published Dec 24, 2021
·Updated
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Software
2 affected components
invoiceninja Invoice Ninja<4.5.47
invoiceninja Invoice Ninja>=5.0<5.3.33
Remediation
Event History
Dec 24, 2021
CVE Published
via MITRE·08:10 PM
Data Sourced
via MITRE·08:10 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2021-3977?
CVE-2021-3977 is a vulnerability in invoiceninja that allows for Cross-site Scripting (XSS) attacks.
2
What is the severity of CVE-2021-3977?
The severity of CVE-2021-3977 is medium with a CVSS score of 5.4.
3
How does CVE-2021-3977 affect invoiceninja?
CVE-2021-3977 affects invoiceninja versions up to 4.5.47 and versions between 5.0 and 5.3.33.
4
How can I fix CVE-2021-3977 in invoiceninja?
To fix CVE-2021-3977 in invoiceninja, you should update to a version beyond 5.3.33 or apply the following commit: [link to GitHub commit]
5
What is the Common Weakness Enumeration (CWE) for CVE-2021-3977?
The CWE for CVE-2021-3977 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation.