Vulnerability Description
A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Noobaa-Operator | < 5.7.0 |
| Redhat | Openshift Container Platform | 4.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1950479Issue TrackingThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1950479Issue TrackingThird Party Advisory
FAQ
What is CVE-2021-3529?
CVE-2021-3529 is a vulnerability with a CVSS score of 7.1 (HIGH). A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a pay...
How severe is CVE-2021-3529?
CVE-2021-3529 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3529?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Noobaa-Operator, Redhat Openshift Container Platform.