The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is     not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a     malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
    (CVE-2021-3427)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is
    not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a
    malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
    (CVE-2021-3427)

The remote host is affected by the vulnerability described in GLSA-202210-07 (Deluge: Cross-Site Scripting)

  - The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is     not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a     malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
    (CVE-2021-3427)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
223850	Linux Distros Unpatched Vulnerability : CVE-2021-3427	Nessus	Misc.	medium
410757	SCA: security update for deluge (GHSA-5c8p-qhch-qhx6)	Tenable Cloud Security	SCA Checks	medium
410757	SCA: security update for deluge (GHSA-5c8p-qhch-qhx6)	Tenable Self-Hosted Container Security	SCA Checks	medium
166159	GLSA-202210-07 : Deluge: Cross-Site Scripting	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2021-3427

medium

Tenable Plugins

medium

medium

medium

medium