CVE-2021-46827

Published: Jul 13, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.

Affected (39)

Products: Sync: Oxygen Publishing Engine, Oxygen Xml Author, Oxygen Xml Developer, Oxygen Xml Editor, Oxygen Xml Webhelp

Sync

5 products

Oxygen Publishing Engine

Configuration A

39 vulnerable

Vulnerable Software	Affected Versions
Sync Oxygen Publishing Engine	Before 22.1
Sync Oxygen Publishing Engine	Version 22.1 2020061014
Sync Oxygen Publishing Engine	Version 22.1 2020072823
Sync Oxygen Publishing Engine	Version 22.1 2020100801
Sync Oxygen Publishing Engine	Version 22.1 2020121711
Sync Oxygen Publishing Engine	Version 23.1 2021040717
Sync Oxygen Publishing Engine	Version 23.1 2021060401
Sync Oxygen Xml Author	Before 22.1
Sync Oxygen Xml Author	Version 22.1 2020061102
Sync Oxygen Xml Author	Version 22.1 2020072902
Sync Oxygen Xml Author	Version 22.1 2020100710
Sync Oxygen Xml Author	Version 22.1 2020121713
Sync Oxygen Xml Author	Version 23.1 2021030206
Sync Oxygen Xml Author	Version 23.1 2021040908
Sync Oxygen Xml Author	Version 23.1 2021061407
Sync Oxygen Xml Developer	Before 22.1
Sync Oxygen Xml Developer	Version 22.1 2020061102
Sync Oxygen Xml Developer	Version 22.1 2020072902
Sync Oxygen Xml Developer	Version 22.1 2020100710
Sync Oxygen Xml Developer	Version 22.1 2020121713
Sync Oxygen Xml Developer	Version 23.1 2021030206
Sync Oxygen Xml Developer	Version 23.1 2021040908
Sync Oxygen Xml Developer	Version 23.1 2021061407
Sync Oxygen Xml Editor	Before 22.1
Sync Oxygen Xml Editor	Version 22.1 2020061102
Sync Oxygen Xml Editor	Version 22.1 2020072902
Sync Oxygen Xml Editor	Version 22.1 2020100710
Sync Oxygen Xml Editor	Version 22.1 2020121713
Sync Oxygen Xml Editor	Version 23.1 2021030206
Sync Oxygen Xml Editor	Version 23.1 2021040908
Sync Oxygen Xml Editor	Version 23.1 2021061407
Sync Oxygen Xml Webhelp	Before 22.1
Sync Oxygen Xml Webhelp	Version 22.1 2020061014
Sync Oxygen Xml Webhelp	Version 22.1 2020072412
Sync Oxygen Xml Webhelp	Version 22.1 2020100208
Sync Oxygen Xml Webhelp	Version 22.1 2020121713
Sync Oxygen Xml Webhelp	Version 23.1 2021030210
Sync Oxygen Xml Webhelp	Version 23.1 2021040711
Sync Oxygen Xml Webhelp	Version 23.1 2021060306

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.oxygenxml.com/security/advisory/SYNC-2021-072301.html

Source: cve@mitre.org

PatchVendor Advisory

https://www.oxygenxml.com/security/advisory/SYNC-2021-072301.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.