Stored XSS Vulnerability in Ericsson CodeChecker Reports Viewer
CVE-2021-44217

6.1MEDIUM

Key Information:

Vendor: Ericsson
Status: Codechecker
Vendor: CVE Published:; 18 January 2022

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-44217?

A Stored Cross-site Scripting (XSS) vulnerability exists in Ericsson CodeChecker through version 6.18.0. This security flaw arises from improper input validation in the comments component of the reports viewer, enabling remote attackers to inject arbitrary web scripts or HTML. Exploiting this vulnerability via the POST JSON data of the /CodeCheckerService API can lead to session hijacking and other malicious activities. Organizations using affected versions should prioritize upgrading to mitigate risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-44217
Created by Hyperkopite