What is CVE-2021-37788?

CVE-2021-37788 is a medium-severity vulnerability in Gurock Testrail, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 5.4/10. Published 2021-08-09.

How severe is CVE-2021-37788?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2021-37788 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Gurock Testrail

CVE-2021-37788

A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.

EPSS: 0.015 (72.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

Affected products

Gurock Testrail — versions 5.3.0.3603
N/a — versions n/a

Weakness classification (CWE)

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames (Clickjacking)

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-37788?: CVE-2021-37788 is a medium-severity vulnerability in Gurock Testrail, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 5.4/10. Published 2021-08-09.
How severe is CVE-2021-37788?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2021-37788 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.