CVE-2021-32737

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
sulu	sulu	< 1.6.41

References

https://github.com/sulu/sulu/releases/tag/1.6.41Release Notes, Third Party Advisory
https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory
https://github.com/sulu/sulu/releases/tag/1.6.41Release Notes, Third Party Advisory
https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory

Timeline

Published: Jul 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327386.5js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 CVE-2021-327398.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-327407.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource con CVE-2021-327415.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327429.1Vapor is a web framework for Swift. In versions 4.47.1 and prior, bug in the `Data.init(base32Encoded:)` function opens up the potential for CVE-2021-327438.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2021-327447.5Collabora Online is a collaborative online office suite. In versions prior to 4.2.17-1 and version 6.4.9-5, unauthenticated attackers are ab CVE-2021-327456.1Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-CVE-2021-327465.3Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` m CVE-2021-327476.5Icinga Web 2 is an open source monitoring web interface, framework, and command-line interface. A vulnerability in which custom variables ar CVE-2021-327484.3Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Platform Interface") pro CVE-2021-327498.1fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0