CVE-2021-32852mediumCWE-79

CVE-2021-32852: falha de média gravidade em countly-server

countly-server vulnerable to Cross-site Scripting

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar countly-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.9%
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Countly · countly-server
CVEs relacionadas — countly-server

No mesmo produto, das mais perigosas para as menos.

CVE-2022-29174HIGHPredictable password reset token may lead to account takeover in countly-serverEPSS 1.5%CVE-2026-42270HIGHcountly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream ExceptionEPSS 0.5%CVE-2026-41582HIGHcountly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal FilesEPSS 0.5%CVE-2026-42269HIGHcountly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory DeletionEPSS 0.5%CVE-2026-44977CRITICALcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session contextEPSS 0.4%CVE-2026-87803HIGHCVE-2026-87803EPSS 0.3%