Security readout for executives and security teams
Plain-English summary
CloudISO can store attacker-supplied JavaScript through an insufficiently filtered field on a time management page. The attacker needs authenticated access, and another user must view the affected content. Business impact is mainly account misuse, data exposure, or unauthorized actions inside CloudISO, not direct server takeover.
Executive priority
Treat as a moderate application risk. Prioritize remediation if CloudISO is used for business-critical workflows, has broad internal access, or is viewed by privileged users. Lack of affected-version detail means owners should verify vendor guidance rather than assume non-exposure.
Technical view
CVE-2021-30174 is CWE-79 stored XSS in RiyaLab CloudISO. Event item creation on the time management page does not properly filter special characters in a specific field. CVSS 3.1 is 5.4: network reachable, low complexity, low privileges required, user interaction required, changed scope, low confidentiality and integrity impact.
Likely exposure
Exposure is limited to organizations running RiyaLab CloudISO, but affected versions are unspecified in the provided sources. Risk is highest where many users can create or edit event items and higher-privilege users view time management content.
Exploitation context
The sources describe remote authenticated exploitation. There is no KEV listing and no provided evidence of active exploitation. Successful impact depends on stored content being viewed by another user, consistent with the CVSS user-interaction requirement.
Researcher notes
The public data is sparse: product and vulnerable area are identified, but no affected version range, patch version, or detailed trigger conditions are included. Avoid assuming unauthenticated access or active exploitation. Focus validation on stored XSS behavior in the time management event item path.
Mitigation direction
- Check RiyaLab or TWCERT guidance for fixed versions or official mitigation.
- Restrict CloudISO access to trusted users and networks where possible.
- Limit event item creation or editing to necessary roles only.
- Review existing time management entries for suspicious script-like content.
- Monitor CloudISO activity for unusual account or administrative actions.
Validation and detection
- Inventory all CloudISO deployments and exposed management interfaces.
- Confirm whether deployed versions match vendor or TWCERT affected guidance.
- Review time management event fields for unsafe stored special characters.
- Verify role controls for creating and editing event items.
- In a controlled environment, confirm special characters render safely as text.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-30174 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.