CVE-2021-33570

MEDIO 5.4CVE-2021-33570 · Published 25/05/2021 · updated 17/06/2026

In breve

CVE-2021-33570 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda postbird (postbird project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.6%, superiore al 89.4% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
postbird postbird_project	`= 0.8.4`	No fix yet

Description

Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.

References

packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html · Exploit
packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html · Third Party Advisory
Paxa/postbird · Issue Tracking
Paxa/postbird · Issue Tracking
Paxa/postbird · Issue Tracking
Tridentsec-io/postbird · Exploit
tridentsec.io/blogs/postbird-cve-2021-33570 · Broken Link
exploit-db.com/exploits/49910 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free