CVE-2021-41555: XSS
UNSUPPORTED WHEN ASSIGNED In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41555?
CVE-2021-41555 has a severity rating that may vary but is generally recognized as a moderate risk due to its XSS vulnerability.
How do I fix CVE-2021-41555?
To fix CVE-2021-41555, implement proper input validation and output encoding for user-generated content within the application.
What type of vulnerability is CVE-2021-41555?
CVE-2021-41555 is classified as a cross-site scripting (XSS) vulnerability affecting Archibus Web Central.
Which version of Archibus Web Central is affected by CVE-2021-41555?
Archibus Web Central version 21.3.3.815 is specifically affected by CVE-2021-41555.
What is the potential impact of exploiting CVE-2021-41555?
Exploiting CVE-2021-41555 could allow an attacker to execute arbitrary scripts in the context of a user's browser session.