countly-server vulnerable to Cross-site Scripting
CVE-2021-32852

5.4MEDIUM

Key Information:

Vendor

Countly

Status
Countly-server
Vendor
CVE Published:
20 February 2023

What is CVE-2021-32852?

Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.

Affected Version(s)

countly-server 21.11

References

https://securitylab.github.com/advisories/GHSL-2021-104-c...
https://github.com/Countly/countly-server/releases/tag/v2...
https://github.com/Countly/countly-server/blob/6b90bb775e...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.