CVE-2021-32737

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-32737

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32737.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-32737

Aliases

GHSA-gm2x-6475-g9r8

Published

2021-07-02T18:15:09Z

Modified

2026-10-20T10:54:42Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.

References

Affected packages

Git / github.com/sulu/sulu

Affected ranges

Type

GIT

Repo

https://github.com/sulu/sulu

Events

Introduced

Fixed

9a569c43076f60dab0407f21a862bea76f23b3ae

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.6.41"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "1.6.41",
            "range":  [
                {
                    "fixed":  "9a569c43076f60dab0407f21a862bea76f23b3ae"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.2.0

0.4.0

0.5.0

0.6.0

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.8

0.7.0

0.7.1

0.8.0

0.8.3

0.8.4

0.8.5

1.*

1.0.0

1.0.0-RC1

1.0.0-RC2

1.0.0-RC3

1.0.1

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.1.10

1.1.11

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.3.0

1.3.0-RC1

1.3.0-RC2

1.3.0-RC3

1.3.1

1.3.2

1.3.3

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8

1.4.9

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0

1.6.1

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

1.6.2

1.6.20

1.6.21

1.6.22

1.6.23

1.6.24

1.6.25

1.6.26

1.6.27

1.6.28

1.6.29

1.6.3

1.6.30

1.6.31

1.6.32

1.6.33

1.6.34

1.6.35

1.6.36

1.6.37

1.6.38

1.6.39

1.6.4

1.6.40

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32737.json"