XSS Vulnerability in Webrecorder pywb Affects User Security
CVE-2021-39286

6.1MEDIUM

Key Information:

Vendor

Webrecorder

Status
Pywb
Vendor
CVE Published:
18 August 2021

What is CVE-2021-39286?

The Webrecorder pywb product, in versions prior to 2.6.0, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises due to the improper management of template rendering, specifically the failure to automatically escape Jinja2 templates. As a result, attackers can potentially inject malicious scripts that execute in the context of the victim's browser, leading to serious security risks. Users are advised to upgrade to version 2.6.0 or later to mitigate this vulnerability and ensure better protection against XSS attacks.

References

https://github.com/webrecorder/pywb/commit/f7bd84cdacdd66...
x_refsource_MISC
https://github.com/webrecorder/pywb/compare/v-2.5.0...v-2...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.