CVE-2021-43659: XSS
Published Mar 24, 2022
·Updated
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
Affected Software
1 affected component
Halo Halo=1.4.14
Event History
Mar 24, 2022
CVE Published
via MITRE·01:09 PM
Data Sourced
via MITRE·01:09 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-43659?
CVE-2021-43659 is considered a high severity vulnerability due to the potential for stored XSS attacks.
2
How do I fix CVE-2021-43659?
To fix CVE-2021-43659, ensure that the file upload functionality validates and restricts the types of files that can be uploaded.
3
What types of attacks can result from CVE-2021-43659?
CVE-2021-43659 can lead to stored XSS attacks, allowing an attacker to execute arbitrary scripts in a user's browser.
4
Which version of Halo is affected by CVE-2021-43659?
CVE-2021-43659 specifically affects Halo version 1.4.14.
5
Is there a patch available for CVE-2021-43659?
As of now, there is no official patch available for CVE-2021-43659, so users should implement workarounds to mitigate the risk.