CVE-2021-43810 Cross-site Scripting (XSS) when redirect an url
Attackers can execute malicious scripts via reflected XSS in the redirect URL parameter, affecting Admidio user management systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-43810?
CVE-2021-43810 is a high-severity cross-site scripting vulnerability in admidio, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.
Weakness: CWE-79
Which versions are affected by CVE-2021-43810?
It affects 1 product.
Products include Admidio Admidio.
How do I fix CVE-2021-43810?
No fix has been published for CVE-2021-43810 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-43810 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-43810 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
Sources
Also known as GHSA-3qgf-qgc3-42hh.