CVE-2021-46827 Cross-site scripting in n/a
Attackers can execute JavaScript via XSS in Oxygen XML WebHelp search proposals by tricking users into typing specific text.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-46827?
CVE-2021-46827 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.
Weakness: CWE-79
Which versions are affected by CVE-2021-46827?
It affects 5 products.
Products include Sync Oxygen Publishing Engine, Sync Oxygen Xml Author, Sync Oxygen Xml Developer, Sync Oxygen Xml Editor, Sync Oxygen Xml Webhelp.
How do I fix CVE-2021-46827?
No fix has been published for CVE-2021-46827 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-46827 being exploited?
There is no known exploitation of CVE-2021-46827 in the wild and no public exploit code.
Sources
Also known as GHSA-rq7j-w5gx-99gf.