Critical severity · published Feb 20, 2023
CVE-2021-32852
countly-server vulnerable to Cross-site Scripting
9.0
CVSS
0.9%
EPSS
No
On KEV
Description
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
countly-server · Countly
21.11 before 21.11 · source: vendor
CS
Countly Server · Count
before 21.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32852
Third Party Advisory
https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112
Third Party Advisory
https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95
Release Notes
https://github.com/Countly/countly-server/releases/tag/v21.11
Exploit
https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/
More from countly-server
9.0
CVE-2026-44977
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
8.1
CVE-2026-42269
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
8.1
CVE-2022-29174
Predictable password reset token may lead to account takeover in countly-server
7.5
CVE-2026-41582
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
7.5
CVE-2026-42270
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception