CVE-2021-35506
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
An XSS vulnerability in Afian FileRun 2021.03.26 allows an attacker to inject malicious scripts when an administrator uses the HTML Editor to preview or edit a crafted document.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions performed under the administrator's privileges.
Recommendation
Immediately update to the latest version of Afian FileRun and avoid opening suspicious documents in the HTML Editor.
Other vulnerabilities in Afian FileRun
See all- CVE-2021-35505High
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the magick binary.
- CVE-2021-35504High
A vulnerability in Afian FileRun 2021.03.26 allows remote code execution by administrators via the Check Path value for the ffmpeg binary.
- CVE-2021-35503Medium
Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.
Original NVD description (English source)
Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS