CVE-2021-23824

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Crow	>= unspecified, < 0.3+4

References

https://github.com/CrowCpp/Crow/pull/317Issue Tracking, Patch, Third Party Advisory
https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336164Exploit, Third Party Advisory
https://github.com/CrowCpp/Crow/pull/317Issue Tracking, Patch, Third Party Advisory
https://github.com/CrowCpp/Crow/releases/tag/v0.3%2B4Release Notes, Third Party Advisory
https://snyk.io/vuln/SNYK-UNMANAGED-CROW-2336164Exploit, Third Party Advisory

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-238275.5Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive medi CVE-2021-23834.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-238354.9An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP reque CVE-2021-238364.8An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request bod CVE-2021-238376.5An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP requ CVE-2021-238384.8An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request bo CVE-2021-238393.7OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent CVE-2021-23844.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-238407.5Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input len CVE-2021-238415.9The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number d CVE-2021-238427.1Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrie CVE-2021-238437.8The Bosch software tools AccessIPConfig.exe and AmcIpConfig.exe are used to configure certains settings in AMC2 devices. The tool allows put