CVEvulnerability
CVE-2021-33570
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-05-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
Affected configurations
• postbird project postbird 0.8.4
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html Third Party Advisory, VDB Entry
- https://github.com/Paxa/postbird/issues/132 Issue Tracking, Third Party Advisory
- https://github.com/Paxa/postbird/issues/133 Issue Tracking, Third Party Advisory
- https://github.com/Paxa/postbird/issues/134 Issue Tracking, Third Party Advisory
- https://github.com/Tridentsec-io/postbird Exploit, Third Party Advisory
- https://tridentsec.io/blogs/postbird-cve-2021-33570/ Broken Link, Third Party Advisory, URL Repurposed
- https://www.exploit-db.com/exploits/49910 Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html Third Party Advisory, VDB Entry
- https://github.com/Paxa/postbird/issues/132 Issue Tracking, Third Party Advisory
- https://github.com/Paxa/postbird/issues/133 Issue Tracking, Third Party Advisory
- https://github.com/Paxa/postbird/issues/134 Issue Tracking, Third Party Advisory
- https://github.com/Tridentsec-io/postbird Exploit, Third Party Advisory
- https://tridentsec.io/blogs/postbird-cve-2021-33570/ Broken Link, Third Party Advisory, URL Repurposed
- https://www.exploit-db.com/exploits/49910 Exploit, Third Party Advisory, VDB Entry