CVE-2021-43810 - OpenCVE

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Admidio	Admidio

Configuration 1 [-]

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21
https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b
https://github.com/Admidio/admidio/releases/tag/v4.0.12
https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-12-07T22:00:12

Updated: 2024-08-04T04:03:08.738Z

Reserved: 2021-11-16T00:00:00

Link: CVE-2021-43810

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-12-07T22:15:06.997

Modified: 2021-12-09T19:44:54.367

Link: CVE-2021-43810

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "admidio", "vendor": "Admidio", "versions": [{"status": "affected", "version": "< 4.0.12"}]}], "descriptions": [{"lang": "en", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-07T22:00:12", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}], "source": {"advisory": "GHSA-3qgf-qgc3-42hh", "discovery": "UNKNOWN"}, "title": "Cross-site Scripting (XSS) when redirect an url", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-43810", "STATE": "PUBLIC", "TITLE": "Cross-site Scripting (XSS) when redirect an url"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "admidio", "version": {"version_data": [{"version_value": "< 4.0.12"}]}}]}, "vendor_name": "Admidio"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh", "refsource": "CONFIRM", "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"name": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"name": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"name": "https://github.com/Admidio/admidio/releases/tag/v4.0.12", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}]}, "source": {"advisory": "GHSA-3qgf-qgc3-42hh", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:03:08.738Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-43810", "datePublished": "2021-12-07T22:00:12", "dateReserved": "2021-11-16T00:00:00", "dateUpdated": "2024-08-04T04:03:08.738Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "49D9EA34-4C02-4E67-866C-144321A50907", "versionEndExcluding": "4.0.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}, {"lang": "es", "value": "Admidio es un sistema gratuito de administraci\u00f3n de usuarios de c\u00f3digo abierto para sitios web de organizaciones y grupos. Se presenta una vulnerabilidad de tipo cross-site scripting en Admidio versiones anteriores a 4.0.12. La vulnerabilidad de tipo XSS reflejada se produce porque el archivo redirect.php no comprueba correctamente el valor del par\u00e1metro url. Mediante esta vulnerabilidad, un atacante es capaz de ejecutar scripts maliciosos. Este problema est\u00e1 parcheado en la versi\u00f3n 4.0.12"}], "id": "CVE-2021-43810", "lastModified": "2021-12-09T19:44:54.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-12-07T22:15:06.997", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}