CVE-2021-45086

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612Exploit, Vendor Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5042Third Party Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612Exploit, Vendor Advisory
https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5042Third Party Advisory

Timeline

Published: Dec 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-450876.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by CVE-2021-450886.1XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.CVE-2021-450895.2Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.CVE-2021-450909.8Stormshield Endpoint Security before 2.1.2 allows remote code execution.CVE-2021-450914.3Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.CVE-2021-450929.8Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete CVE-2021-450945.4Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.CVE-2021-450955.5pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.CVE-2021-450964.3KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730 CVE-2021-450975.5KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without CVE-2021-450987.5An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with r CVE-2021-450998.8The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requ