CVE-2021-31330

A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
VendorProductVersion
reviewboardreview_board
3.0.20
reviewboardreview_board
4.0:beta1
reviewboardreview_board
4.0:beta2
reviewboardreview_board
4.0:rc1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://mattschmidt.net/2021/04/14/review-board-xss-discovered/
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/
https://mattschmidt.net/2021/04/14/review-board-xss-discovered/
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/