CVE-2021-21259

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada hedgedoc. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.2. As a workaround, disallow loading JavaScript from 3rd party sites using the `Content-Security-Policy` header. Note that this will break some embedded content.

Rincian

Terbit di NVD

22 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hackmdio/codimd/issues/1648 exploit · patch · advisory pihak ketiga
• https://github.com/hedgedoc/hedgedoc/commit/35b0d39a12aa35f27fba8c1f50b1886706e7efef patch · advisory pihak ketiga
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 release notes · advisory pihak ketiga
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw advisory pihak ketiga