CVE-2021-40868: XSS

Published Sep 21, 2021

Updated

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.

Affected Software

1 affected component

Cloudron Cloudron=6.2

Event History

Sep 21, 2021

CVE Published

via MITRE·04:49 PM

Data Sourced

via MITRE·04:49 PM

Description

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What must an attacker do to trigger the issue?

An attacker must persuade a user to visit a crafted Cloudron login-page URL containing a malicious returnTo parameter. No attacker authentication is required, but user interaction is required.

What is the potential impact if the attack succeeds?

The CVSS vector indicates low-impact disclosure and modification of data, with the impact extending beyond the vulnerable security authority. Availability impact is not indicated.

Which Cloudron version is identified as affected?

The provided information identifies Cloudron 6.2 as affected. No fixed version or workaround is specified.

CVE-2021-40868: XSS

Affected Software

Event History

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the potential impact if the attack succeeds?

Which Cloudron version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger the issue?

What is the potential impact if the attack succeeds?

Which Cloudron version is identified as affected?