CVE Vulnerability

CVE-2021-27945

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+Scripting Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:squirro:squirro:*:*:*:*:*:*:*:*
Information

Published : 2021-04-08 05:15

Updated : 2021-04-14 08:17

NVD link : CVE-2021-27945

Mitre link : CVE-2021-27945

Products Affected
No products.
CWE
CWE-79