Is CVE-2021-36686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-36686 being exploited in the wild.

How severe is CVE-2021-36686?

Low severity, with a CVSS score of 3.1, published 26 January 2023.

Which products and versions are affected?

yapi-vendor (npm) SEMVER:introduced=0,last_affected=1.9.1; Ymfe Yapi up to 1.9.1.

Is there a fix for CVE-2021-36686?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-36686 attacked?

It is attacked over the network.

Am I affected by CVE-2021-36686?

Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-36686: YApi stored cross-site scripting in interface remarks

CVE-2021-36686 · Severity: low · CVSS 3.1 · Published 2023-01-26

YApi is an open-source API documentation and management platform. A stored XSS vulnerability in the interface remarks field allows users to inject malicious JavaScript code that executes when other team members view interface documentation. An attacker can use this to steal session tokens, credentials, or perform unauthorized actions on behalf of victims viewing the affected interface.

Technologies: yapi-vendor (npm), Ymfe Yapi. Vendors: npm, Ymfe.

Quick answers

Is CVE-2021-36686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-36686 being exploited in the wild.
How severe is CVE-2021-36686?: Low severity, with a CVSS score of 3.1, published 26 January 2023.
Which products and versions are affected?: yapi-vendor (npm) SEMVER:introduced=0,last_affected=1.9.1; Ymfe Yapi up to 1.9.1.
Is there a fix for CVE-2021-36686?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-36686 attacked?: It is attacked over the network.
Am I affected by CVE-2021-36686?: Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a stored cross-site scripting (CWE-79) vulnerability in the yapi-vendor npm package affecting version 1.9.1 and earlier. The vulnerability exists in the interface edit page's remarks field, which fails to properly sanitize user input before storing and rendering HTML content. Attackers with access to create or edit interfaces can inject malicious SVG or HTML payloads (e.g., <svg onload=alert()> or <video onerror=alert()>) that are stored in the database. When any project member views the interface edit page, the payload is executed in their browser within the context of the application domain. This requires authentication to access the interface editor but affects all users subsequently viewing the compromised interface. No patch information is currently available in the advisory.

Affected products

YMFE yapi-vendor up to 1.9.1

Identifiers

CVE-2021-36686
GHSA-4jqw-vfmj-9rmh

Timeline

2021-05-08: disclosed: Issue #2190 opened reporting stored XSS in remarks
2021-07-09: disclosed: Issue #2240 opened confirming stored XSS via SVG payload in remarks
2023-01-26: advisory: CVE-2021-36686 published and GHSA-4jqw-vfmj-9rmh advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.