CVE-2021-39267

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19Release Notes, Vendor Advisory
https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory
https://thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18/Exploit, Third Party Advisory
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19Release Notes, Vendor Advisory
https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory
https://thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18/Exploit, Third Party Advisory

Timeline

Published: Aug 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392686.1Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaSc CVE-2021-39277.8vim is vulnerable to Heap-based Buffer Overflow CVE-2021-392707.5In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.CVE-2021-392718.8OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python c CVE-2021-392725.9Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUT CVE-2021-392738.8In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to CVE-2021-392749.8In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user CVE-2021-392759.8ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functio CVE-2021-392786.1Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-CVE-2021-392798.8Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.CVE-2021-39287.8vim is vulnerable to Use of Uninitialized Variable CVE-2021-392808.8Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affects 2212X before 1.9.1