CVE-2021-44042

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Encoding or Escaping of Output pada uipath assistant. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.

Rincian

Terbit di NVD

14 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.uipath.com/robot/docs/release-notes-2021-10-4 release notes · advisory vendor
• https://docs.uipath.com/robot/docs/uipath-assistant product