CVE-2021-3427

Name
CVE-2021-3427
Description
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
MISC https://dev.deluge-torrent.org/ticket/3459

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:deluge-torrent:deluge:*:*:*:*:*:*:*:* deluge >= None < 2.1.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
deluge 3.16-community 2.0.5-r1 psykose <alice@ayaya.dev> possibly vulnerable