‹ Back to list

CVE-2021-27945

Status: ModifiedMedium (6.1)—
Severity6.1Medium · CVSS 3.1
Exploitation probability0.62 %higher than 49% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.

CVSS

Base score
6.1
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.62 %
Percentile among all scored CVEs
49
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Squirro — Squirro

CWEs

References

Show 2 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-27945",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-08T17:15:13.237",
  "references": [
    {
      "url": "https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+Scripting",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://squirro.atlassian.net/wiki/spaces/DOC/pages/2389672672/CVE-2021-27945+-+Cross-Site+Scripting",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes."
    },
    {
      "lang": "es",
      "value": "Squirro Insights Engine está afectado por una vulnerabilidad Cross-Site Scripting (XSS) Reflejado que afecta a versiones 2.0.0 hasta la 3.2.4 incluyéndola. Un atacante puede utilizar la vulnerabilidad para inyectar código JavaScript malicioso en la aplicación, que será ejecutado en el navegador de cualquier usuario que visualice el contenido relevante de la aplicación. El código suministrado por el atacante puede llevar a cabo una amplia variedad de acciones, tal y como robar los tokens de sesión de las víctimas o las credenciales de inicio de sesión, llevando a cabo acciones arbitrarias en su nombre y registrar sus pulsaciones de teclas"
    }
  ],
  "lastModified": "2026-06-17T03:45:39.360",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:squirro:squirro:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F78C6B4-5F4F-428D-BF19-9DF7E3B8AE27",
              "versionEndIncluding": "3.2.4",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}