What is the CVSS score of CVE-2021-3672?

CVE-2021-3672 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 2.6%.

Is there a public PoC exploit available for CVE-2021-3672?

Yes, a public proof-of-concept exploit is available for CVE-2021-3672. Prioritise patching immediately. EPSS: 2.6%.

Is there a patch available for CVE-2021-3672?

Yes, a patch is available for CVE-2021-3672. Update the affected software to the latest version immediately.

C Ares CVE-2021-3672

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2021-11-23 secalert@redhat.com

XSS C Ares Fedora Enterprise Linux Enterprise Linux Computer Node Enterprise Linux Eus Enterprise Linux For Ibm Z Systems Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Little Endian Enterprise Linux For Power Little Endian Eus Enterprise Linux Server Aus Enterprise Linux Server Tus Enterprise Linux Server Update Services For Sap Solutions Enterprise Linux Tus Enterprise Linux Workstation Sinec Infrastructure Network Services Node Js Pgbouncer

5.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Nov 23, 2021 - 19:15 nvd

MEDIUM 5.6

DescriptionNVD

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

AnalysisAI

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability. Affected products include: C-Ares Project C-Ares, Fedoraproject Fedora, Redhat Enterprise Linux, Redhat Enterprise Linux Computer Node, Redhat Enterprise Linux Eus.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.