What is CVE-2021-33853?

CVE-2021-33853 is a medium-severity vulnerability in X2engine X2crm, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-03-16.

How severe is CVE-2021-33853?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in X2engine X2crm

CVE-2021-33853

A Cross-Site Scripting (XSS) attack can cause arbitrary code (javascript) to run in a user’s browser while the browser is connected to a trusted website. As the vehicle for the attack, the application targets the users and not the application itself. Additionally, the XSS payload is executed when the user attempts to access any page of the CRM.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (43.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

X2engine X2crm — versions 8.0
N/a X2crm — versions 8

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

disclose@cybersecurityworks.com (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-33853?: CVE-2021-33853 is a medium-severity vulnerability in X2engine X2crm, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-03-16.
How severe is CVE-2021-33853?: Medium severity. CVSS v3 base score is 5.4 out of 10.