CVE-2021-3619 — Rapid7 Velociraptor Notebooks Authenticated Persistent XSS
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sni…
Published: 2021-08-17 · CVSS: 3.5 · CVSS 3.1
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7