CVE Vulnerability

CVE-2021-44043

An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload, by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://docs.uipath.com/robot/docs/uipath-assistant Vendor Advisory
https://docs.uipath.com/apps/v2021.10/docs/2021-10-1 Release Notes Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:uipath:app_studio:21.4.4:*:*:*:*:*:*:*
Information

Published : 2021-12-14 06:15

Updated : 2021-12-20 08:33

NVD link : CVE-2021-44043

Mitre link : CVE-2021-44043

Products Affected
No products.
CWE
CWE-79