CVE-2021-3529 Cross-site scripting in noobaa-core
An attacker can inject arbitrary JavaScript into application responses via unmodified input echoing, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-3529?
CVE-2021-3529 is a high-severity cross-site scripting vulnerability in Redhat Openshift Container Platform, published on 2 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.
Weakness: CWE-79
Which versions are affected by CVE-2021-3529?
It affects 2 products.
Products include Redhat Noobaa-Operator, Redhat Openshift Container Platform.
How do I fix CVE-2021-3529?
No fix has been published for CVE-2021-3529 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-3529 being exploited?
There is no known exploitation of CVE-2021-3529 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift Container Platform
Sources
Also known as GHSA-cr32-cm8v-9pww.