CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3529
https://notcve.org/view.php?id=CVE-2021-3529
A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity. Se ha encontrado un fallo en noobaa-core en versiones anteriores a 5.7.0. • https://bugzilla.redhat.com/show_bug.cgi?id=1950479 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3528 – NooBaa: noobaa-operator leaking RPC AuthToken into log files
https://notcve.org/view.php?id=CVE-2021-3528
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration. Se encontró un fallo en noobaa-operator en versiones anteriores a 5.7.0, donde los RPC AuthTokens internos entre el operador noobaa y el core noobaa son filtrados en archivos de registro. Un atacante con acceso a los archivos de registro podría usar este AuthToken para conseguir acceso adicional a la implementación de noobaa y puede leer y modificar la configuración del sistema A flaw was found in NooBaa, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration. • https://bugzilla.redhat.com/show_bug.cgi?id=1955601 https://access.redhat.com/security/cve/CVE-2021-3528 • CWE-522: Insufficiently Protected Credentials CWE-532: Insertion of Sensitive Information into Log File •