CVE-2021-32812

    Dashboard / Vulnerabilities / CVE-2021-32812

    CVE-2021-32812

    Published: 2 Aug 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Monkshu is an enterprise application server for mobile apps (iOS and Android), responsive HTML 5 apps, and JSON API services. In version 2.90 and earlier, there is a reflected cross-site scripting vulnerability in frontend HTTP server. The attacker can send in a carefully crafted URL along with a known bug in the server which will cause a 500 error, and the response will then embed the URL provided by the hacker. The impact is moderate as the hacker must also be able to craft an HTTP request which should cause a 500 server error. None such requests are known as this point. The issue is patched in version 2.95. As a workaround, one may use a disk caching plugin.

    References: https://github.com/TekMonksGitHub/monkshu/releases/tag/v2.95, https://github.com/TekMonksGitHub/monkshu/security/advisories/GHSA-hcpx-66hq-7g4x, https://github.com/TekMonksGitHub/monkshu/commit/4601a9bfdc934d7ac32619ce621652fad0cf452b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8cdcefb1f91221e66056bc1b20298f111be4a131
    Fixed -None

    Affected versions

    2.90

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32812 | CVE-DB