CVE-2021-32812

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79CWE-116

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-328138.1Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handCVE-2021-328148.1Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabCVE-2021-328155.5Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The assertion faiCVE-2021-328167.5ProtonMail Web Client is the official AngularJS web client for the ProtonMail secure email service. ProtonMail Web Client before version 3.1CVE-2021-328176.8express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the ExpCVE-2021-328185.4haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express CVE-2021-328198.8Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data withCVE-2021-32827.5HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without autheCVE-2021-328208.6Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options thCVE-2021-328217.5MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulneraCVE-2021-328225.3The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosurCVE-2021-328233.7In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for