CVE-2021-33570

Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table

published May 25, 2021

CVSS
—
EPSS
4%
Percentile
89.3
In the wild
Unconfirmed
What it is

Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03561 · 89.3th percentile
Published
2021-05-25T21:06Z
EPSS history
Timeline
  • 25 MAY 21:06Z
    Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table
    cvelistv5