CVE-2021-40888: XSS
Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Projectsendto a version that resolves this vulnerability.Fixed in r1295 - Configuration
In process.php, update the returnFilesIds() function to properly sanitize/escape any echoed output data returned to the client, since r1295 is affected by XSS due to lack of sanitization.
Projectsend (process.php) returnFilesIds() output sanitization = Apply output sanitization/escaping when echoing data from returnFilesIds() to prevent XSS
Event History
Frequently Asked Questions
What is CVE-2021-40888?
CVE-2021-40888 is a vulnerability in Projectsend version r1295 that allows for Cross Site Scripting (XSS) attacks.
How does CVE-2021-40888 work?
CVE-2021-40888 works by not properly sanitizing input data when echo output data in the returnFilesIds() function, allowing low privilege users to execute scripting code.
What is the severity of CVE-2021-40888?
The severity of CVE-2021-40888 is medium with a CVSS score of 5.4.
Is Projectsend version r1295 affected by CVE-2021-40888?
Yes, Projectsend version r1295 is affected by CVE-2021-40888.
How can CVE-2021-40888 be fixed?
To fix CVE-2021-40888, it is recommended to upgrade to a version of Projectsend that includes the necessary fixes or patches.