CVE-2021-21283

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2021-21283
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2021-01-26 21:15:00 UTC
Updated2023-11-07 03:29:00 UTC
DescriptionFlarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through the m.trust() helper. This resulted in an HTML injection where <script> tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed. Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned. On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited. Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted. The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension. Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Flarum Sticky 0.1.0 beta14 All All
Application Flarum Sticky 0.1.0 beta15 All All
Application Flarum Sticky 0.1.0 beta14 All All
Application Flarum Sticky 0.1.0 beta15 All All

References

ReferenceSourceLinkTags
Security update to Flarum Sticky 0.1.0-beta.15.1 - Flarum Community discuss.flarum.org
XSS in pinned discussion excerpt · Advisory · flarum/sticky · GitHub CONFIRM github.com Third Party Advisory
Fix evaluation of post content by m.trust() by SychO9 · Pull Request #24 · flarum/sticky · GitHub MISC github.com Patch, Third Party Advisory
Security update to Flarum Sticky 0.1.0-beta.15.1 - Flarum Community MISC discuss.flarum.org Mitigation, Vendor Advisory
Fix evaluation of post content by m.trust() (#24) · flarum/sticky@7ebd304 · GitHub MISC github.com Patch, Third Party Advisory
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report