CVE-2021-28079
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
jamovi是jamovi开源的一个应用软件。一个免费且开放的统计平台。 Jamovi 1.6.18版本及之前版本存在安全漏洞，攻击者可利用该漏洞可以创建一个包含有效负载的.omv (Jamovi)文档。被受害者打开后，有效载荷就会被触发。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-28079
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
jamovi 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
jamovi是jamovi开源的一个应用软件。一个免费且开放的统计平台。 Jamovi 1.6.18版本及之前版本存在安全漏洞，攻击者可利用该漏洞可以创建一个包含有效负载的.omv (Jamovi)文档。被受害者打开后，有效载荷就会被触发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2021-28079
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | POC Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered. | https://github.com/g33xter/CVE-2021-28079 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-28079
请登录查看更多情报信息。
Other References for CVE-2021-28079 (2)
-
https://www.jamovi.org x_refsource_MISC
Same Patch Batch · n/a · 2021-04-26 · 20 CVEs total
| CVE-2021-23382 | 5.3 MEDIUM | Regular Expression Denial of Service (ReDoS) |
| CVE-2021-23365 | 4.8 MEDIUM | Authentication Bypass |
| CVE-2021-25839 | MINTHCM 安全漏洞 | |
| CVE-2021-31804 | leocad 资源管理错误漏洞 | |
| CVE-2021-31803 | cPanel 跨站脚本漏洞 | |
| CVE-2021-25927 | safe-flat 安全漏洞 | |
| CVE-2021-25928 | safe-obj 安全漏洞 | |
| CVE-2021-26797 | Hame SD1 Wi-Fi 安全漏洞 | |
| CVE-2021-31802 | NETGEAR R7000 缓冲区错误漏洞 | |
| CVE-2020-15078 | OpenVPN 访问控制错误漏洞 | |
| CVE-2021-25838 | MintHCM 跨站脚本漏洞 | |
| CVE-2021-22669 | Advantech WebAccess SCADA 安全漏洞 | |
| CVE-2021-28399 | Orangehrm 安全漏洞 | |
| CVE-2021-3494 | Foreman 安全漏洞 | |
| CVE-2021-3472 | X.Org X Server 数字错误漏洞 | |
| CVE-2020-36325 | jansson 缓冲区错误漏洞 | |
| CVE-2021-31784 | Open Design Alliance Drawings SDK 缓冲区错误漏洞 | |
| CVE-2021-31783 | LocalFilesEditor 数据伪造问题漏洞 | |
| CVE-2021-31646 | Gestsup 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2021-28079
No comments yet