{
  "schema_version": "1.4.0",
  "id": "GHSA-jpv5-mgqh-93xq",
  "modified": "2022-05-24T19:11:37Z",
  "published": "2022-05-24T19:11:37Z",
  "aliases": [
    "CVE-2021-39267"
  ],
  "details": "Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.",
  "severity": [],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39267"
    },
    {
      "type": "WEB",
      "url": "https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/salesagility/SuiteCRM"
    },
    {
      "type": "WEB",
      "url": "https://thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-18T01:15:00Z"
  }
}