CVE-2021-27938 XSS in CreateQueuedJobTask
An attacker can inject arbitrary scripts via a crafted URL in the CreateQueuedJobTask, potentially leading to code execution or account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-27938?
CVE-2021-27938 is a medium-severity cross-site scripting vulnerability in n/a, published on 16 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
Weakness: CWE-79
Which versions are affected by CVE-2021-27938?
18 open source packages ship an affected version, including symbiote/silverstripe-queuedjobs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symbiote/silverstripe-queuedjobs Packagist | From 3.0.0 | 3.0.2 |
symbiote/silverstripe-queuedjobs Packagist | From 3.0.0 | 3.0.2 |
symbiote/silverstripe-queuedjobs Packagist | From 3.1.0 | 3.1.4 |
symbiote/silverstripe-queuedjobs Packagist | From 3.1.0 | 3.1.4 |
symbiote/silverstripe-queuedjobs Packagist | From 4.0.0 | 4.0.7 |
symbiote/silverstripe-queuedjobs Packagist | From 4.0.0 | 4.0.7 |
12 more packages
symbiote/silverstripe-queuedjobs Packagist | From 4.1.0 | 4.1.2 |
symbiote/silverstripe-queuedjobs Packagist | From 4.1.0 | 4.1.2 |
symbiote/silverstripe-queuedjobs Packagist | From 4.2.0 | 4.2.4 |
symbiote/silverstripe-queuedjobs Packagist | From 4.2.0 | 4.2.4 |
symbiote/silverstripe-queuedjobs Packagist | From 4.3.0 | 4.3.3 |
symbiote/silverstripe-queuedjobs Packagist | From 4.3.0 | 4.3.3 |
symbiote/silverstripe-queuedjobs Packagist | From 4.4.0 | 4.4.3 |
symbiote/silverstripe-queuedjobs Packagist | From 4.4.0 | 4.4.3 |
symbiote/silverstripe-queuedjobs Packagist | From 4.5.0 | 4.5.1 |
symbiote/silverstripe-queuedjobs Packagist | From 4.5.0 | 4.5.1 |
symbiote/silverstripe-queuedjobs Packagist | From 4.6.0 | 4.6.4 |
symbiote/silverstripe-queuedjobs Packagist | From 4.6.0 | 4.6.4 |
Products include Symbiote Silverstripe Queued Jobs.
How do I fix CVE-2021-27938?
Upgrade symbiote/silverstripe-queuedjobs to a fixed version for your release line: 3.0.2, 3.1.4, 4.0.7 or 4.1.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-27938 being exploited?
There is no known exploitation of CVE-2021-27938 in the wild and no public exploit code.
Sources
Also known as GHSA-xgpf-p52j-pf7m.