CVE-2021-20293 Cross-Site Scripting

What is CVE-2021-20293?

CVE-2021-20293 is a medium-severity cross-site scripting vulnerability in Netapp Oncommand Insight, published on 10 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.

Weakness: CWE-79

Which versions are affected by CVE-2021-20293?

4 open source packages ship an affected version, including org.jboss.resteasy:resteasy-bom and org.jboss.resteasy:resteasy-core. It affects 2 products.

Products include Netapp Oncommand Insight, Redhat Resteasy.

How do I fix CVE-2021-20293?

No fix has been published for CVE-2021-20293 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-20293 being exploited?

There is no known exploitation of CVE-2021-20293 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Insight

• CVE-2017-5600 Hardcoded credentials in n/a Critical 9.8
• CVE-2018-1258 Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass High 8.8
• CVE-2020-5421 RFD Protection Bypass via jsessionid High 8.7
• CVE-2022-38733 Auth bypass in OnCommand Insight High 8.6
• CVE-2023-22102 MySQL Connectors takeover vulnerability High 8.3

All Netapp Oncommand Insight vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5h26-c766-g93v.