CVE-2021-44565: XSS
Published Feb 22, 2022
·Updated
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
Affected Software
1 affected component
RosarioSIS RosarioSIS<7.6.1
Remediation
Event History
Feb 22, 2022
CVE Published
via MITRE·07:58 PM
Data Sourced
via MITRE·07:58 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-44565.
2
What is the severity rating of CVE-2021-44565?
CVE-2021-44565 has a severity rating of medium (5.4).
3
How does the Cross Site Scripting (XSS) vulnerability in RosarioSIS before 7.6.1 work?
The XSS vulnerability in RosarioSIS before 7.6.1 allows remote malicious users to inject arbitrary JavaScript or HTML through the xss_clean function in classes/Security.php.
4
Which component of RosarioSIS is affected by this vulnerability?
The vulnerability affects all Markdown input fields in RosarioSIS.
5
How can I fix the Cross Site Scripting (XSS) vulnerability in RosarioSIS?
To fix the XSS vulnerability in RosarioSIS, upgrade to version 7.6.1 or later.