CVE-2021-37833

2021-08-0313:15:09

Debian Security Bug Tracker

security-tracker.debian.org

cve-2021-37833

reflection cross-site scripting

version 3.0.2

hotel druid application

arbitrary execution

javascript commands

unix

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

69.8%

JSON

A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands.

OSVersionArchitecturePackageVersionFilename
Debian12allhoteldruid< 3.0.3-1hoteldruid_3.0.3-1_all.deb
Debian11allhoteldruid<= 3.0.1-1hoteldruid_3.0.1-1_all.deb
Debian999allhoteldruid< 3.0.3-1hoteldruid_3.0.3-1_all.deb
Debian13allhoteldruid< 3.0.3-1hoteldruid_3.0.3-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	hoteldruid	< 3.0.3-1	hoteldruid_3.0.3-1_all.deb
Debian	11	all	hoteldruid	<= 3.0.1-1	hoteldruid_3.0.1-1_all.deb
Debian	999	all	hoteldruid	< 3.0.3-1	hoteldruid_3.0.3-1_all.deb
Debian	13	all	hoteldruid	< 3.0.3-1	hoteldruid_3.0.3-1_all.deb