Security readout for executives and security teams
Plain-English summary
CVE-2021-27695 is a stored cross-site scripting issue in openMAINT 2.1-3.3-b. An attacker can save malicious script or HTML in “Add” section fields such as Name and Code. When another user views affected records, the script may run in that user’s browser.
Executive priority
Treat as a medium-priority application security issue. It is not listed as actively exploited in the provided sources, but stored XSS can affect privileged users and operational data workflows. Prioritize if openMAINT is externally reachable or used by many non-administrative users.
Technical view
The CVE describes multiple stored XSS flaws in openMAINT 2.1-3.3-b affecting input in Add sections, including Add Card Building and Floor, through Name and Code parameters. No CVSS score, CWE, vendor advisory, or fixed version is included in the provided sources. Exploit-DB has a public entry for this CVE.
Likely exposure
Organizations running openMAINT 2.1-3.3-b are potentially exposed, especially if untrusted or low-privileged users can create records. Exposure is higher where openMAINT is internet-accessible or broadly available to contractors, tenants, or operational staff.
Exploitation context
The source bundle includes an Exploit-DB reference, indicating public exploit information exists. The sources do not show CISA KEV listing or confirmed active exploitation. Successful impact likely depends on an attacker’s ability to submit data into affected Add sections and lure or wait for another user to view it.
Researcher notes
Evidence is limited to the CVE description and Exploit-DB reference. The affected range is stated as openMAINT 2.1-3.3-b. No official patch, CVSS vector, authentication requirement, or exact role requirement is provided. Avoid assuming broader openMAINT versions are affected without vendor confirmation.
Mitigation direction
- Identify whether openMAINT 2.1-3.3-b is deployed.
- Check official openMAINT or maintainer guidance for fixed versions or patches.
- Restrict access to openMAINT to trusted networks and users.
- Limit record-creation permissions to users who need them.
- Review stored Name and Code fields for suspicious script-like content.
Validation and detection
- Inventory openMAINT versions and exposed access paths.
- Confirm whether untrusted users can access Add sections.
- Review application logs for unusual record creation activity.
- Inspect recently created Building, Floor, and similar records.
- Verify remediation against vendor guidance when available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-27695 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/49649CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.