CVE-2021-43776

Katalog CVE

CVSS 6.1 · Medium EPSS 0,68%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada linuxfoundation auth backend. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

Rincian

Terbit di NVD

26 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/backstage/backstage/security/advisories/GHSA-w7fj-336r-vw49 advisory pihak ketiga
• https://github.com/backstage/backstage/tree/master/plugins/auth-backend product · advisory pihak ketiga