CVE-2021-41765 in the critical feed json
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated at…
published 4y ago modified 4mo ago also BIT-resourcespace-2021-41765 , EUVD-2021-28774
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 67.8%
- EPSS 67.8% chance of exploitation in 30 days, percentile 99.3%
- public exploits
- 0
- none known
Summary
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.
Is CVE-2021-41765 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
67.85% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- horizon3.ai https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | resourcespace | >=9.5.0, <=9.5.0 >=9.6.0, <=9.6.0 |
no fix listed |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
horizon3.ai
/multiple-vulnerabilities-in-resourcespace/
exploit, third-party-advisory, web
-
svn.resourcespace.com
/svn/rs/releases/9.6/pages/edit_fields/9_ajax/add_keyword.php
broken-link, vendor-advisory, web
Sources
- CVE List CVE-2021-41765
- NVD CVE-2021-41765
- OSV BIT-resourcespace-2021-41765
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.