CVE-2021-32852
- Source
- https://cve.org/CVERecord?id=CVE-2021-32852
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32852.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-32852
- Published
- 2023-02-20T22:15:11Z
- Modified
- 2026-10-20T10:53:47Z
- Severity
-
- 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
- References
-
- https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112
- https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95
- https://github.com/Countly/countly-server/releases/tag/v21.11
- https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/
Affected packages
Git / github.com/countly/countly-server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/countly/countly-server
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:count:countly_server:*:*:*:*:community:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "21.11" } ], "source": "CPE_RANGE" }, { "original_tag": "v21.11", "range": [ { "fixed": "91bd1e96833279ee1029f456322a93c53b7cb64e" } ], "source": "REFERENCES_TAG" } ] }