Medium severity · published Aug 25, 2022
CVE-2021-3914
It was found that the smallrye health metrics UI component did not properly sanitize some user inputs
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Build OF Quarkus · Redhat
before 2.7.5 · source: NVD
OA
Openshift Application Runtimes · Redhat
1.0 · source: NVD
SH
Smallrye Health · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3914
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3914
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3914
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2018015
More from Build OF Quarkus
9.8
CVE-2022-4116
A vulnerability was found in quarkus
9.1
CVE-2023-6394
Quarkus: graphql operations over websockets bypass
8.1
CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of…
8.1
CVE-2023-2974
A vulnerability was found in quarkus-core
7.8
CVE-2022-1011
A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write()