CVE-2021-44543

An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
privoxyprivoxy
𝑥
< 3.0.33
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
privoxy
bullseye
3.0.32-2+deb11u1
fixed
bookworm
3.0.34-1
fixed
sid
3.0.34-6
fixed
trixie
3.0.34-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
privoxy
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
ignored
hirsute
ignored
focal
Fixed 3.0.28-2ubuntu0.2
released
bionic
Fixed 3.0.26-5ubuntu0.3
released
xenial
needed
trusty
needed
Common Weakness Enumeration
References
https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C
https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=0e668e9409c
https://www.privoxy.org/3.0.33/user-manual/whatsnew.html%2C
https://www.privoxy.org/gitweb/?p=privoxy.git%3Ba=commit%3Bh=0e668e9409c