{"id":"CVE-2021-44217","aliases":["EUVD-2022-0591","GHSA-fxmx-pfm2-85m2","PYSEC-2022-43181","PYSEC-2026-625"],"status":"published","title":"Cross-site Scripting in Ericsson CodeChecker","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01701,"percentile":0.7753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-79"],"published":"2022-01-18T15:00:55Z","modified":"2026-10-20T10:54:09Z","exploits":[{"source":"pocgithub","id":"Hyperkopite/CVE-2021-44217","title":"Hyperkopite/CVE-2021-44217","date":"2021-11-25","url":"https://github.com/Hyperkopite/CVE-2021-44217"}],"fixes":[{"ecosystem":"PyPI","package":"codechecker","fixed_in":["6.18.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.18.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.18.2"}]}],"versions":["6.16.0","6.16.0a1","6.17.0","6.18.0","6.18.1"]},{"source":"osv","ecosystem":"PyPI","package":"codechecker-api"},{"source":"osv","ecosystem":"PyPI","package":"codechecker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.18.2"}]}],"versions":["6.16.0","6.16.0a1","6.17.0","6.18.0","6.18.1"]}],"products":[{"vendor":"ericsson","product":"codechecker"}],"references":[{"url":"https://codechecker-demo.eastus.cloudapp.azure.com/","tags":["x_refsource_MISC","x_transferred","Permissions Required","report"]},{"url":"https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.png","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Ericsson/codechecker/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/Hyperkopite/CVE-2021-44217/blob/main/README.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/Ericsson/codechecker/pull/3549","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44217","tags":["advisory"]},{"url":"https://github.com/Ericsson/codechecker/commit/72ee51158e6d81150320223b85410c179b9ee2b1","tags":["web"]},{"url":"https://github.com/Ericsson/codechecker/releases/tag/v6.18.2","tags":["web"]},{"url":"https://codechecker-demo.eastus.cloudapp.azure.com","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/codechecker-api/PYSEC-2022-43181.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fxmx-pfm2-85m2","tags":["advisory"]},{"url":"https://github.com/Ericsson/codechecker","tags":["package"]},{"url":"https://pypi.org/project/codechecker","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-44217","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-18T15:00:55Z","modified":"2024-08-04T04:17:24.836Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2022-0591","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-18T15:00:55Z","modified":"2024-08-04T04:17:24Z","updated_at":"2026-11-03T03:24:12.005069Z"}],"ghsa":[{"id":"GHSA-fxmx-pfm2-85m2","title":"Cross-site Scripting in Ericsson CodeChecker","description":"In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-21T23:32:32Z","modified":"2026-05-19T20:19:28Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2021-44217","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-18T15:15:08.253Z","modified":"2026-06-17T04:12:04.33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:03.821385Z"}],"osv":[{"id":"CVE-2021-44217","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-18T15:15:08.253Z","modified":"2026-10-20T10:54:09.808068432Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"PYSEC-2022-43181","description":"In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-18T15:15:08.253Z","modified":"2026-07-06T08:11:11.912089942Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"GHSA-fxmx-pfm2-85m2","title":"Cross-site Scripting in Ericsson CodeChecker","description":"In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2022-01-21T23:32:32Z","modified":"2026-07-06T08:11:11.912089942Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"PYSEC-2026-625","title":"Cross-site Scripting in Ericsson CodeChecker","description":"In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.","status":"published","published":"2026-07-02T14:13:14.73942Z","modified":"2026-07-06T08:11:11.912089942Z","updated_at":"2026-11-02T15:52:57.671918Z"}]}}