Read the docs
TI-2021-21519 Aliases CVE-2021-46827GHSA-rq7j-w5gx-99gf

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x…

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.

Why it matters now

EPSS 0.00467 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:sync:oxygen_publishing_engine:*:*:*:*:*:*:*:*before 22.1VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020061014:*:*:*:*:*:*22.1 2020061014VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020072823:*:*:*:*:*:*22.1 2020072823VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020100801:*:*:*:*:*:*22.1 2020100801VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020121711:*:*:*:*:*:*22.1 2020121711VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:23.1:2021040717:*:*:*:*:*:*23.1 2021040717VulnerableSync
cpe:2.3:a:sync:oxygen_publishing_engine:23.1:2021060401:*:*:*:*:*:*23.1 2021060401VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:*:*:*:*:*:*:*:*before 22.1VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:22.1:2020061102:*:*:*:*:*:*22.1 2020061102VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:22.1:2020072902:*:*:*:*:*:*22.1 2020072902VulnerableSync
  • cpe:2.3:a:sync:oxygen_publishing_engine:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020061014:*:*:*:*:*:* Versions 22.1 2020061014 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020072823:*:*:*:*:*:* Versions 22.1 2020072823 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020100801:*:*:*:*:*:* Versions 22.1 2020100801 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:22.1:2020121711:*:*:*:*:*:* Versions 22.1 2020121711 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:23.1:2021040717:*:*:*:*:*:* Versions 23.1 2021040717 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_publishing_engine:23.1:2021060401:*:*:*:*:*:* Versions 23.1 2021060401 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:22.1:2020061102:*:*:*:*:*:* Versions 22.1 2020061102 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:22.1:2020072902:*:*:*:*:*:* Versions 22.1 2020072902 Vulnerable ·Sync
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sync:oxygen_xml_author:22.1:2020100710:*:*:*:*:*:*22.1 2020100710VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:22.1:2020121713:*:*:*:*:*:*22.1 2020121713VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:23.1:2021030206:*:*:*:*:*:*23.1 2021030206VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:23.1:2021040908:*:*:*:*:*:*23.1 2021040908VulnerableSync
cpe:2.3:a:sync:oxygen_xml_author:23.1:2021061407:*:*:*:*:*:*23.1 2021061407VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:*:*:*:*:*:*:*:*before 22.1VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020061102:*:*:*:*:*:*22.1 2020061102VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020072902:*:*:*:*:*:*22.1 2020072902VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020100710:*:*:*:*:*:*22.1 2020100710VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020121713:*:*:*:*:*:*22.1 2020121713VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021030206:*:*:*:*:*:*23.1 2021030206VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021040908:*:*:*:*:*:*23.1 2021040908VulnerableSync
cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021061407:*:*:*:*:*:*23.1 2021061407VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:*:*:*:*:*:*:*:*before 22.1VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020061102:*:*:*:*:*:*22.1 2020061102VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020072902:*:*:*:*:*:*22.1 2020072902VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020100710:*:*:*:*:*:*22.1 2020100710VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020121713:*:*:*:*:*:*22.1 2020121713VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021030206:*:*:*:*:*:*23.1 2021030206VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021040908:*:*:*:*:*:*23.1 2021040908VulnerableSync
cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021061407:*:*:*:*:*:*23.1 2021061407VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:*:*:*:*:*:*:*:*before 22.1VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020061014:*:*:*:*:*:*22.1 2020061014VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020072412:*:*:*:*:*:*22.1 2020072412VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020100208:*:*:*:*:*:*22.1 2020100208VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020121713:*:*:*:*:*:*22.1 2020121713VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021030210:*:*:*:*:*:*23.1 2021030210VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021040711:*:*:*:*:*:*23.1 2021040711VulnerableSync
cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021060306:*:*:*:*:*:*23.1 2021060306VulnerableSync
  • cpe:2.3:a:sync:oxygen_xml_author:22.1:2020100710:*:*:*:*:*:* Versions 22.1 2020100710 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:22.1:2020121713:*:*:*:*:*:* Versions 22.1 2020121713 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:23.1:2021030206:*:*:*:*:*:* Versions 23.1 2021030206 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:23.1:2021040908:*:*:*:*:*:* Versions 23.1 2021040908 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_author:23.1:2021061407:*:*:*:*:*:* Versions 23.1 2021061407 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020061102:*:*:*:*:*:* Versions 22.1 2020061102 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020072902:*:*:*:*:*:* Versions 22.1 2020072902 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020100710:*:*:*:*:*:* Versions 22.1 2020100710 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:22.1:2020121713:*:*:*:*:*:* Versions 22.1 2020121713 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021030206:*:*:*:*:*:* Versions 23.1 2021030206 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021040908:*:*:*:*:*:* Versions 23.1 2021040908 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_developer:23.1:2021061407:*:*:*:*:*:* Versions 23.1 2021061407 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020061102:*:*:*:*:*:* Versions 22.1 2020061102 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020072902:*:*:*:*:*:* Versions 22.1 2020072902 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020100710:*:*:*:*:*:* Versions 22.1 2020100710 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:22.1:2020121713:*:*:*:*:*:* Versions 22.1 2020121713 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021030206:*:*:*:*:*:* Versions 23.1 2021030206 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021040908:*:*:*:*:*:* Versions 23.1 2021040908 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_editor:23.1:2021061407:*:*:*:*:*:* Versions 23.1 2021061407 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:*:*:*:*:*:*:*:* Versions before 22.1 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020061014:*:*:*:*:*:* Versions 22.1 2020061014 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020072412:*:*:*:*:*:* Versions 22.1 2020072412 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020100208:*:*:*:*:*:* Versions 22.1 2020100208 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:22.1:2020121713:*:*:*:*:*:* Versions 22.1 2020121713 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021030210:*:*:*:*:*:* Versions 23.1 2021030210 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021040711:*:*:*:*:*:* Versions 23.1 2021040711 Vulnerable ·Sync
  • cpe:2.3:a:sync:oxygen_xml_webhelp:23.1:2021060306:*:*:*:*:*:* Versions 23.1 2021060306 Vulnerable ·Sync

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-46827
  2. 2026-10-03 Alias added: GHSA-rq7j-w5gx-99gf

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences