CVE-2021-43776CWE-79

XSS vulnerability in @backstage/plugin-auth-backend

High · published November 26, 2021

CVSS v3.1
7.4
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00678 · 51.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-26T18:15Z
EPSS history
Timeline
  • 26 NOV 18:15Z
    XSS vulnerability in @backstage/plugin-auth-backend
    cvelistv5