CVE-2021-44565

francoisjacquet/rosariosis

on gitlab

Published

February 24, 2022

Severity

CVSS v3:

5.4 MEDIUM

CVSS v2:

3.5 LOW

Description

A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.

References

https://gitlab.com/francoisjacquet/rosariosis/-/issues/307
https://gitlab.com/francoisjacquet/rosariosis/-/commit/0f5d1f1d193bc6b711d1644f172579d498ec1636
https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md#changes-in-761

Configurations

CPE23	Version Start	Version End	Exact Version
cpe:2.3:a:rosariosis:rosariosis::::::::	n/a	7.6.1	*

External Links

NVD - CVE-2021-44565