CVE-2021-31330

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://mattschmidt.net/2021/04/14/review-board-xss-discovered/Exploit, Third Party Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/Release Notes, Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/Release Notes, Vendor Advisory
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/Release Notes, Vendor Advisory
https://mattschmidt.net/2021/04/14/review-board-xss-discovered/Exploit, Third Party Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/3.0.21/Release Notes, Vendor Advisory
https://www.reviewboard.org/docs/releasenotes/reviewboard/4.0-rc-2/Release Notes, Vendor Advisory
https://www.reviewboard.org/news/2021/04/14/review-board-3-0-21-and-4-0-rc-2-security-bug-fixes-and-docker/Release Notes, Vendor Advisory

Timeline

Published: May 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-313379.8The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow CVE-2021-313387.8A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuratio CVE-2021-313394.3A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an CVE-2021-31347.8Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878.CVE-2021-313407.5A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2),CVE-2021-313414.3Uploading a table mapping using a manipulated XML file results in an exception that could expose information about the application-server an CVE-2021-313428.8The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack pro CVE-2021-313438.8The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack prope CVE-2021-313445.3A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-313459.1A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-313469.1A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions CVE-2021-313476.5An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafte