CVE-2021-44565 - A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML

Back Back to CVE browser

MEDIUM

A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML

Published Feb 22, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://github.com/advisories/GHSA-44cg-qcpr-fwjh
Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761
x_refsource_MISCRelease NotesThird Party Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636
x_refsource_MISCPatchThird Party Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/issues/307
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-44565

Link	Providers	Tags
https://github.com/advisories/GHSA-44cg-qcpr-fwjh		Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761		x_refsource_MISCRelease NotesThird Party Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636		x_refsource_MISCPatchThird Party Advisory
https://gitlab.com/francoisjacquet/rosariosis/-/issues/307		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-44565