1. Home
  2. CVE Database
  3. CVE-2021-32019
MEDIUM · 6.1

CVE-2021-32019

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the af...

Vulnerability Description

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
OpenwrtOpenwrt>= 19.07.0, < 19.07.8

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-32019?

CVE-2021-32019 is a vulnerability with a CVSS score of 6.1 (MEDIUM). There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the af...

How severe is CVE-2021-32019?

CVE-2021-32019 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-32019?

Check the references section above for vendor advisories and patch information. Affected products include: Openwrt Openwrt.