CVE-2021-43675: XSS
Published Dec 15, 2021
·Updated
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user.
Affected Software
2 affected components
Lycheeorganisation Lychee=3.2.16
Lycheeorg Lychee=3.2.16
Event History
Dec 15, 2021
CVE Published
via MITRE·03:24 PM
Data Sourced
via MITRE·03:24 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-43675?
CVE-2021-43675 has a medium severity due to its potential for Cross Site Scripting (XSS) attacks.
2
How do I fix CVE-2021-43675?
To fix CVE-2021-43675, upgrade to a version of Lychee that is later than 3.2.16 where this vulnerability has been addressed.
3
What is the impact of CVE-2021-43675?
The impact of CVE-2021-43675 allows an attacker to execute arbitrary scripts in the context of the affected user’s session.
4
Is CVE-2021-43675 widely exploitable?
Yes, CVE-2021-43675 is widely exploitable as it can be triggered through user-controlled inputs.
5
What software is affected by CVE-2021-43675?
CVE-2021-43675 affects Lychee version 3.2.16.