CVE-2021-38138

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release.

Affected products

Onenav

Onenav

= 0.9.12

Fix

Available

CVSS 3.1

5.4 MEDIUM

EPSS

1.5% (72th percentile)

Weakness

CWE-79

NVD status

Modified

Published

2021-08-05