CVE-2021-33570
23Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendepss 3.6%
probabilidad de explotación
3.6%top 12% de las CVE
explotación observada
noninguna fuente lo reporta
3 exploit(s) público(s)
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
Productos afectados
n/a · n/aPoCs públicas encontradas — 3
cve_referencewww.exploit-db.com/exploits/49910no verificadocve_referencepacketstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlno verificadocve_referencepacketstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlhttp://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlhttps://github.com/Paxa/postbird/issues/132https://github.com/Paxa/postbird/issues/133https://github.com/Paxa/postbird/issues/134https://github.com/Tridentsec-io/postbirdhttps://tridentsec.io/blogs/postbird-cve-2021-33570/https://www.exploit-db.com/exploits/49910