CVE-2021-20829

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WESEEK, Inc.	GROWI	versions v4.2.19 and earlier

References

https://jvn.jp/en/vu/JVNVU94889258/index.htmlThird Party Advisory
https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/Vendor Advisory
https://jvn.jp/en/vu/JVNVU94889258/index.htmlThird Party Advisory
https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/Vendor Advisory

Timeline

Published: Sep 21, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20838.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: User Responsibilities). Supported versions that are affe CVE-2021-208318.8Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of CVE-2021-208325.3InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead CVE-2021-208337.4The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle at CVE-2021-208346.1Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS v CVE-2021-208357.5Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App CVE-2021-208366.5Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause informa CVE-2021-208379.8Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r CVE-2021-208387.5Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML Exte CVE-2021-208396.5Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML Exte CVE-2021-20848.2Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2021-208406.1Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacke