How severe is CVE-2021-32661?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.3 out of 10.

What type of vulnerability is CVE-2021-32661?

This is classified as CWE-77, which is a common weakness in software security.

CVE-2021-32661 - HIGH Severity | CVSS 7.3

Vulnerability Description

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin (`@backstage/plugin-techdocs`) prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page. The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store. The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.

Related Vulnerabilities

CVE-1999-0039

HIGH

CVSS:7.3(High)

webdist CGI program (webdist.cgi) in SGI IRIX allows remote attackers to execute arbitrary commands via shell metacharacters in the distloc parameter.

CWE-771999

CVE-2017-15403

HIGH

CVSS:7.3(High)

Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute ...

CWE-772017

CVE-2018-19015

HIGH

CVSS:7.3(High)

An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file. An attacker could exploit th...

CWE-772018

CVE-2019-20655

HIGH

CVSS:7.3(High)

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR500 before 2.3.2.56 and XR700 before 1.0.1.20.

CWE-772019

CVE-2020-4059

HIGH

CVSS:7.3(High)

In mversion before 2.0.0, there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vul...

CWE-772020

CVE-2021-27702

HIGH

CVSS:7.3(High)

Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard.

CWE-772021