OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Why it matters now
EPSS 0.00865 58th percentileScored 2026-11-07
Fix Fixed org.opencrx:opencrx-core (Maven): 5.2.0org.opencrx:opencrx-core-models (Maven): 5.2.0+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| org.opencrx | opencrx-core-config | 4.0.0 and later | — | No fix listed | CNA |
| — | org.opencrx:opencrx-core (Maven) | 4.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-rwh9-8xx8-4wfm |
| — | org.opencrx:opencrx-core-models (Maven) | 4.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-rwh9-8xx8-4wfm |
| — | org.opencrx:opencrx-core-config (Maven) | 4.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-rwh9-8xx8-4wfm |
| — | org.opencrx:opencrx-client (Maven) | 4.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-rwh9-8xx8-4wfm |
| — | org.opencrx:opencrx-gradle (Maven) | 4.0.0 to before 5.2.0 | 5.2.0 | Patch available | GHSA-rwh9-8xx8-4wfm |
- opencrx-core-config Vendororg.opencrx Affected 4.0.0 and later Fixed in — No fix listed CNA
- org.opencrx:opencrx-core (Maven) Vendor— Affected 4.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-rwh9-8xx8-4wfm
- org.opencrx:opencrx-core-models (Maven) Vendor— Affected 4.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-rwh9-8xx8-4wfm
- org.opencrx:opencrx-core-config (Maven) Vendor— Affected 4.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-rwh9-8xx8-4wfm
- org.opencrx:opencrx-client (Maven) Vendor— Affected 4.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-rwh9-8xx8-4wfm
- org.opencrx:opencrx-gradle (Maven) Vendor— Affected 4.0.0 to before 5.2.0 Fixed in 5.2.0 Patch available GHSA-rwh9-8xx8-4wfm
Remediation
- Fix · GHSA-rwh9-8xx8-4wfm org.opencrx:opencrx-core (Maven) Fixed in 5.2.0 Advisory →
- Fix · GHSA-rwh9-8xx8-4wfm org.opencrx:opencrx-core-models (Maven) Fixed in 5.2.0 Advisory →
- Fix · GHSA-rwh9-8xx8-4wfm org.opencrx:opencrx-core-config (Maven) Fixed in 5.2.0 Advisory →
- Fix · GHSA-rwh9-8xx8-4wfm org.opencrx:opencrx-client (Maven) Fixed in 5.2.0 Advisory →
- Fix · GHSA-rwh9-8xx8-4wfm org.opencrx:opencrx-gradle (Maven) Fixed in 5.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-25959
- 2026-10-03 Alias added: GHSA-rwh9-8xx8-4wfm
References
More Opencrx vulnerabilities
- TI-2022-18982 OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the… CVSS 3.1MEDIUM 5.3
- TI-2023-21563 OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. CVSS 3.1MEDIUM 6.1
- TI-2023-21562 OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. CVSS 3.1MEDIUM 6.1
- TI-2023-21561 OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. CVSS 3.1MEDIUM 6.1
- TI-2023-21560 OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. CVSS 3.1MEDIUM 6.1
- TI-2023-21559 OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-25959 · CVE Program
- CVE-2021-25959 · NVD
- FIRST EPSS
- GHSA-rwh9-8xx8-4wfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences