CVE-2021-32853

MEDIUMNuclei

Erxes vulnerable to Cross-site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-32853 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

erxes

Browse npm / erxes
CVE List0.22.3 to ≤ 0.22.3affected

erxes

Browse npm / erxes
GitHub AdvisoryThrough 1.0.1affected

Nuclei templates

1
ProjectDiscoveryCRITICALErxes <0.23.0 - Cross-Site ScriptingCVSS 9.6

Erxes before 0.23.0 contains a cross-site scripting vulnerability. The value of topicID parameter is not escaped and is triggered in the enclosing script tag.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to Erxes version 0.23.0 or later to mitigate the vulnerability.

WeaknessesCWE-79
Authorsdwisiswant0
Template tagscve2021cvexsserxesossvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CPE: cpe:2.3:a:erxes:erxes:*:*:*:*:*:*:*:*
Shodan: http.title:"erxes"
FOFA: title="erxes"
Google: intitle:"erxes"
https://securitylab.github.com/advisories/GHSL-2021-103-erxes/ https://nvd.nist.gov/vuln/detail/CVE-2021-3285 https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/views/widget.ejs#L14 https://github.com/erxes/erxes/blob/f131b49add72032650d483f044d00658908aaf4a/widgets/server/index.ts#L54

Source: ProjectDiscovery

References

5