CVEvulnerability
CVE-2021-31330
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-05-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
Affected configurations
• reviewboard review board 3.0.20
• reviewboard review board 4.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://mattschmidt.net/2021/04/14/review-board-xss-discovered/ Exploit, Third Party Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/ Release Notes, Vendor Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/ Release Notes, Vendor Advisory
- https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/ Release Notes, Vendor Advisory
- https://mattschmidt.net/2021/04/14/review-board-xss-discovered/ Exploit, Third Party Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/ Release Notes, Vendor Advisory
- https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/ Release Notes, Vendor Advisory
- https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/ Release Notes, Vendor Advisory