CVE-2021-42119 Stored XSS in Search Function in TopEase

What is CVE-2021-42119?

CVE-2021-42119 is a high-severity cross-site scripting vulnerability in Business-DNA Solutions GmbH TopEase, published on 30 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

Weakness: CWE-79

Which versions are affected by CVE-2021-42119?

It affects 1 product.

Products include Businessdnasolutions Topease.

How do I fix CVE-2021-42119?

No fix has been published for CVE-2021-42119 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-42119 being exploited?

There is no known exploitation of CVE-2021-42119 in the wild and no public exploit code.

Other vulnerabilities in Business-DNA Solutions GmbH TopEase

• CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase High 8.1
• CVE-2021-42118 Stored XSS in TopEase High 8.1
• CVE-2021-42544 Lack of Rate limiting in Authentication in TopEase High 7.5
• CVE-2021-42123 Missing Upload Filter in TopEase High 7.3
• CVE-2021-42120 Missing Character Length (Denial of Service) in TopEase Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hxq-v55q-xvxq.