CVE-2021-33570
23Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendepss 3.6%
probabilidade de exploração
3.6%top 12% das CVEs
exploração observada
nãonenhuma fonte reporta
3 exploit(s) público(s)
Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 3
cve_referencewww.exploit-db.com/exploits/49910não verificadocve_referencepacketstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlnão verificadocve_referencepacketstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.htmlhttp://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.htmlhttps://github.com/Paxa/postbird/issues/132https://github.com/Paxa/postbird/issues/133https://github.com/Paxa/postbird/issues/134https://github.com/Tridentsec-io/postbirdhttps://tridentsec.io/blogs/postbird-cve-2021-33570/https://www.exploit-db.com/exploits/49910