CVE-2021-44217

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://codechecker-demo.eastus.cloudapp.azure.com/Permissions Required
https://github.com/Ericsson/codechecker/pull/3549Patch, Third Party Advisory
https://github.com/Ericsson/codechecker/releasesRelease Notes, Third Party Advisory
https://github.com/Hyperkopite/CVE-2021-44217/blob/main/README.mdExploit, Third Party Advisory
https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.pngThird Party Advisory
https://codechecker-demo.eastus.cloudapp.azure.com/Permissions Required
https://github.com/Ericsson/codechecker/pull/3549Patch, Third Party Advisory
https://github.com/Ericsson/codechecker/releasesRelease Notes, Third Party Advisory
https://github.com/Hyperkopite/CVE-2021-44217/blob/main/README.mdExploit, Third Party Advisory
https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.pngThird Party Advisory

Timeline

Published: Jan 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-442199.8Gin-Vue-Admin before 2.4.6 mishandles a SQL database.CVE-2021-44224.3The POST SMTP Mailer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.20. This is due CVE-2021-442217.5A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The affected systems do not properly validate inp CVE-2021-442229.1A vulnerability has been identified in SIMATIC eaSie Core Package (All versions < V22.00). The underlying MQTT service of affected systems d CVE-2021-442239.8WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via CVE-2021-442248.2A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurat CVE-2021-442255.4In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manip CVE-2021-442267.3Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROG CVE-2021-442278.8In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new adm CVE-2021-4422810.0Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log mess CVE-2021-44234.3The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missi CVE-2021-442306.5PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead