CVE-2021-3914 SmallRye Health UI Cross-site Scripting vulnerability

What is CVE-2021-3914?

CVE-2021-3914 is a medium-severity cross-site scripting vulnerability in smallrye-health, published on 25 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

Weakness: CWE-79

Which versions are affected by CVE-2021-3914?

2 open source packages ship an affected version, including io.smallrye:smallrye-health-ui. It affects 3 products.

Products include Redhat Build of Quarkus, Redhat Openshift Application Runtimes, Redhat Smallrye Health.

How do I fix CVE-2021-3914?

Upgrade io.smallrye:smallrye-health-ui to 3.1.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-3914 being exploited?

There is no known exploitation of CVE-2021-3914 in the wild and no public exploit code.

Other vulnerabilities in smallrye-health

• CVE-2022-4492 Undertow client not checking server identity presented by server certificate in https connections High 7.5
• CVE-2023-2974 quarkus-core vulnerable to client driven TLS cipher downgrading Medium 6.5
• CVE-2023-1664 Keycloak Untrusted Certificate Validation vulnerability Medium 6.5
• CVE-2023-6393 Quarkus: potential invalid reuse of context when @cacheresult on a uni is used Medium 5.3
• CVE-2021-3536 Cross-site Scripting in Wildfly Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvc3-wvxr-7cmf.