CVE-2021-27938

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

0.75%

Published

Mar 16, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

Affected Products (9)

symbiote · silverstripe_queued_jobs (up to 3.0.2)vulnerable

symbiote · silverstripe_queued_jobs (up to 3.1.4)vulnerable

symbiote · silverstripe_queued_jobs (up to 4.0.7)vulnerable

symbiote · silverstripe_queued_jobs (up to 4.1.2)vulnerable

symbiote · silverstripe_queued_jobs (up to 4.2.4)vulnerable

symbiote · silverstripe_queued_jobs (up to 4.3.3)vulnerable

symbiote · silverstripe_queued_jobs (up to 4.4.3)vulnerable