CVE-2021-46827
Medium
Description
An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.
SeverityMedium
CVSS6.1
Exploit probability—
ProductSync Oxygen Publishing Engine
PublishedJul 13, 2022
First seenJul 13, 2022
How to fix
Update
- sync oxygen_publishing_engine22.1 or later
- sync oxygen_xml_author22.1 or later
- sync oxygen_xml_developer22.1 or later
- sync oxygen_xml_editor22.1 or later
- sync oxygen_xml_webhelp22.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sync oxygen_publishing_engine | v < 22.1, 22.1, 23.1 | 22.1 |
| sync oxygen_xml_author | v < 22.1, 22.1, 23.1 | 22.1 |
| sync oxygen_xml_developer | v < 22.1, 22.1, 23.1 | 22.1 |
| sync oxygen_xml_editor | v < 22.1, 22.1, 23.1 | 22.1 |
| sync oxygen_xml_webhelp | v < 22.1, 22.1, 23.1 | 22.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.