CVE-2021-34370

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.

6.1 MediumPublic exploitDisputed

CVE-2021-34370 is a medium vulnerability (CVSS 6.1) in Accela Civic Platform, published June 9, 2021. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.00%, the 95th percentile.

What does this mean?

Severity: 6.1 MediumCVSS 3.1, NVD
Exploit chance: 10.00%EPSS, 95th percentile
Exploitation: None known2 public exploits
Fixed in: No fix listedNo source names one

Description

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

10.00%Up 9.6 points since Jun 10, 2021

Affected products

accela civic platform

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)	2021-06-14
Nuclei	Accela Civic Platform <=21.1 - Cross-Site Scripting

What each source reports

NVD Score used6.1

Record: CVE-2021-34370
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2021-34370
Updated: 2026-11-02

EUVDEUVD-2021-21029No score

Record: EUVD-2021-21029
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m5fq-23j5-h7j76.1

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS.