CVE-2021-43810 - Vulnerability Details - OpenCVE

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.72861.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Admidio

admidio

affected

Version	Status	Constraints
`< 4.0.12`	affected	—

Configuration 1 [-]

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors	Products
Admidio Subscribe	Admidio Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21
https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b
https://github.com/Admidio/admidio/releases/tag/v4.0.12
https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.57108}`	epss `{'score': 0.62973}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-12-07T22:00:12.000Z

Updated: 2024-08-04T04:03:08.738Z

Reserved: 2021-11-16T00:00:00.000Z

Link: CVE-2021-43810

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-07T22:15:06.997

Modified: 2024-11-21T06:29:50.403

Link: CVE-2021-43810

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-79

{"containers": {"cna": {"affected": [{"product": "admidio", "vendor": "Admidio", "versions": [{"status": "affected", "version": "< 4.0.12"}]}], "descriptions": [{"lang": "en", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-07T22:00:12.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}], "source": {"advisory": "GHSA-3qgf-qgc3-42hh", "discovery": "UNKNOWN"}, "title": "Cross-site Scripting (XSS) when redirect an url", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-43810", "STATE": "PUBLIC", "TITLE": "Cross-site Scripting (XSS) when redirect an url"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "admidio", "version": {"version_data": [{"version_value": "< 4.0.12"}]}}]}, "vendor_name": "Admidio"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh", "refsource": "CONFIRM", "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"name": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"name": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"name": "https://github.com/Admidio/admidio/releases/tag/v4.0.12", "refsource": "MISC", "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}]}, "source": {"advisory": "GHSA-3qgf-qgc3-42hh", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:03:08.738Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-43810", "datePublished": "2021-12-07T22:00:12.000Z", "dateReserved": "2021-11-16T00:00:00.000Z", "dateUpdated": "2024-08-04T04:03:08.738Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*", "matchCriteriaId": "49D9EA34-4C02-4E67-866C-144321A50907", "versionEndExcluding": "4.0.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12."}, {"lang": "es", "value": "Admidio es un sistema gratuito de administraci\u00f3n de usuarios de c\u00f3digo abierto para sitios web de organizaciones y grupos. Se presenta una vulnerabilidad de tipo cross-site scripting en Admidio versiones anteriores a 4.0.12. La vulnerabilidad de tipo XSS reflejada se produce porque el archivo redirect.php no comprueba correctamente el valor del par\u00e1metro url. Mediante esta vulnerabilidad, un atacante es capaz de ejecutar scripts maliciosos. Este problema est\u00e1 parcheado en la versi\u00f3n 4.0.12"}], "id": "CVE-2021-43810", "lastModified": "2024-11-21T06:29:50.403", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-07T22:15:06.997", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://github.com/Admidio/admidio/releases/tag/v4.0.12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}