FKIE_CVE-2021-27945

Vulnerability from fkie_nvd - Published: 2021-04-08 17:15 - Updated: 2026-06-17 03:45
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
References
cve@mitre.orghttps://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+ScriptingPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+ScriptingPatch, Vendor Advisory
Impacted products
Vendor Product Version
squirro squirro *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squirro:squirro:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F78C6B4-5F4F-428D-BF19-9DF7E3B8AE27",
              "versionEndIncluding": "3.2.4",
              "versionStartIncluding": "2.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims\u0027 session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes."
    },
    {
      "lang": "es",
      "value": "Squirro Insights Engine est\u00e1 afectado por una vulnerabilidad Cross-Site Scripting (XSS) Reflejado que afecta a versiones 2.0.0 hasta la 3.2.4 incluy\u00e9ndola.\u0026#xa0;Un atacante puede utilizar la vulnerabilidad para inyectar c\u00f3digo JavaScript malicioso en la aplicaci\u00f3n, que ser\u00e1 ejecutado en el navegador de cualquier usuario que visualice el contenido relevante de la aplicaci\u00f3n.\u0026#xa0;El c\u00f3digo suministrado por el atacante puede llevar a cabo una amplia variedad de acciones, tal y como robar los tokens de sesi\u00f3n de las v\u00edctimas o las credenciales de inicio de sesi\u00f3n, llevando a cabo acciones arbitrarias en su nombre y registrar sus pulsaciones de teclas"
    }
  ],
  "id": "CVE-2021-27945",
  "lastModified": "2026-06-17T03:45:39.360",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-04-08T17:15:13.237",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+Scripting"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+Scripting"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.