CVE-2021-4072 Cross-site Scripting (XSS) - Stored in elgg/elgg

What is CVE-2021-4072?

CVE-2021-4072 is a critical cross-site scripting vulnerability in elgg/elgg, published on 24 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Weakness: CWE-79

Which versions are affected by CVE-2021-4072?

2 open source packages ship an affected version, including elgg/elgg. It affects 1 product.

Products include Elgg Elgg.

How do I fix CVE-2021-4072?

Upgrade elgg/elgg to 3.3.24 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-4072 being exploited?

There is no known exploitation of CVE-2021-4072 in the wild and no public exploit code.

Other vulnerabilities in elgg/elgg

• CVE-2011-2936 SQL injection in Elgg Critical 9.8
• CVE-2012-6562 Missing authorization in n/a Medium 6.8
• CVE-2011-2935 Elgg Reflected XSS Vulnerability Medium 6.1
• CVE-2019-11016 Elgg open redirect Medium 6.1
• CVE-2021-3980 Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2xw8-j43j-5vxp.