CVE-2021-34370
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
- Record
CVE-2021-34370- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
- Record
CVE-2021-34370- Updated
- 2026-11-02
EUVDEUVD-2021-21029 No score
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.
- Record
EUVD-2021-21029- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m5fq-23j5-h7j7
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.
Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.
- Record
GHSA-m5fq-23j5-h7j7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS) | 2021-06-14 |
| Nuclei | Accela Civic Platform <=21.1 - Cross-Site Scripting |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34370 is a medium vulnerability (CVSS 6.1) in Accela Civic Platform, published June 9, 2021. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.00%, the 95th percentile.