CVE-2021-42750: XSS
Published Aug 12, 2022
·Updated
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.
Affected Software
1 affected component
ThingsBoard ThingsBoard=3.3.1
Event History
Aug 12, 2022
CVE Published
via MITRE·04:52 PM
Data Sourced
via MITRE·04:52 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for the XSS vulnerability in Rule Engine in ThingsBoard 3.3.1?
The vulnerability ID for the XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 is CVE-2021-42750.
2
What is the severity of CVE-2021-42750?
The severity of CVE-2021-42750 is medium with a CVSS score of 4.8.
3
How does the XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 occur?
The XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 occurs when remote attackers with administrative access inject arbitrary JavaScript within the title of a rule node.
4
What software version is affected by CVE-2021-42750?
The software version affected by CVE-2021-42750 is ThingsBoard 3.3.1.
5
How can I fix the XSS vulnerability in Rule Engine in ThingsBoard 3.3.1?
To fix the XSS vulnerability in Rule Engine in ThingsBoard 3.3.1, update to the latest version of ThingsBoard.