CVE-2021-25938

Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

Published: 24/05/2021 Updated: 28/05/2021

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for leveraging self XSS by attackers.

Vulnerable Product	Search on Vulmon	Subscribe to Product
arangodb arangodb

CWE-79 https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25938 https://github.com/arangodb/arangodb/commit/3e486b9bc33cc97e92645dd279899000e57f61f4 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-25938

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect