VulnerabilityModified
CVE-2021-25938
In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to.
MEDIUM 6.1EPSS 0.81%
Does this matter?
Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.
Description
In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- arangodb/arangodb
- Source
- vulnerabilitylab@mend.io
References
- https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938Exploit, Third Party Advisory
- https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.