Kossy up to 0.59 on Perl JSON X-Requested-With privilege escalation

Summaryinfo

A vulnerability marked as problematic has been reported in Kossy up to 0.59 on Perl. This issue affects some unknown processing of the component JSON Handler. This manipulation of the argument X-Requested-With causes an unknown weakness. This vulnerability is tracked as CVE-2021-47157. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Kossy up to 0.59 on Perl and classified as problematic. Affected by this vulnerability is an unknown code of the component JSON Handler. The manipulation of the argument X-Requested-With with an unknown input leads to a unknown weakness. The impact remains unknown. The summary by CVE is:

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2021-47157 since 03/18/2024. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.60 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Kossy

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion