CVE-2021-20785 Cross-site scripting in GroupSession

Medium 4.8 Published 28 Jul 2021 Updated 3 Aug 2024

Remote attackers can inject arbitrary scripts via crafted requests in GroupSession, potentially leading to code execution or account takeover.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-20785?

CVE-2021-20785 is a medium-severity cross-site scripting vulnerability in Japan Total System Co.,Ltd. GroupSession, published on 28 Jul 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.

Weakness: CWE-79

Which versions are affected by CVE-2021-20785?

It affects 3 products.

Products include Groupsession Groupsession, Groupsession Groupsession Bycloud, Groupsession Groupsession Zion.

How do I fix CVE-2021-20785?

No fix has been published for CVE-2021-20785 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-20785 being exploited?

There is no known exploitation of CVE-2021-20785 in the wild and no public exploit code.

Sources

Also known as GHSA-78vr-4c7c-9p9v.