CVE-2021-32852CWE-79

countly-server vulnerable to Cross-site Scripting

Medium · published February 20, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00930 · 60.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-02-20T00:00Z
EPSS history
Timeline
  • 20 FEB 00:00Z
    countly-server vulnerable to Cross-site Scripting
    cvelistv5