CVE-2021-47925
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
CMDBuild 3.3.2 contains multiple stored XSS vulnerabilities allowing authenticated attackers to inject arbitrary HTML/JavaScript via employee card parameters or SVG attachments in class endpoints. Scripts execute when other users view modified records or preview attachments.
Risk Assessment
Risk of session theft, data exfiltration, and unauthorized actions in CMDBuild, potentially affecting configuration management integrity.
Recommendation
Update CMDBuild to the latest version. Implement input filtering and output encoding for all user fields.
Original NVD description (English source)
CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file attachments in the classes endpoint, which execute when other users view the affected records or preview attachments.