CVE-2021-3529CWE-79

A flaw was found in noobaa-core in versions before 5.7.0

published June 2, 2021

CVSS
—
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-02T16:10Z
EPSS history
Timeline
  • 02 JUN 16:10Z
    A flaw was found in noobaa-core in versions before 5.7.0
    cvelistv5