CVE Vulnerability

CVE-2021-25987

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.

1.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.6 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/hexojs/hexo/commit/5170df2d3fa9c69e855c4b7c2b084ebfd92d5200 Patch Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25987 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:hexo:hexo:*:*:*:*:*:node.js:*:*
Information

Published : 2021-11-30 02:15

Updated : 2021-11-30 04:00

NVD link : CVE-2021-25987

Mitre link : CVE-2021-25987

Products Affected
No products.
CWE
CWE-79