CVE-2021-46872

Katalog CVE

CVSS 6.1 · Medium EPSS 0,54%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada nim-lang nim, nim-lang nimforum. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Nim before 1.6.2. The RST module of the Nim language stdlib, as used in NimForum and other products, permits the javascript: URI scheme and thus can lead to XSS in some applications. (Nim versions 1.6.2 and later are fixed; there may be backports of the fix to some earlier versions. NimForum 2.2.0 is fixed.)

Rincian

Terbit di NVD

13 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forum.nim-lang.org/t/8852 issue tracking · advisory vendor
• https://github.com/nim-lang/Nim/commit/46275126b89218e64844eee169e8ced05dd0e2d7 patch · advisory pihak ketiga
• https://github.com/nim-lang/Nim/pull/19134 patch · advisory pihak ketiga
• https://github.com/nim-lang/Nim/compare/v1.6.0...v1.6.2 advisory pihak ketiga
• https://github.com/nim-lang/nimforum advisory pihak ketiga