CVE-2021-38157

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-06 · updated 2026-06-17
Weakness: CWE-79

Description

LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

Leostream Connection Broker: from 9.0.3 before 9.0.34.3 — fixed in 9.0.34.3

How to fix

Upgrade to a fixed version: Leostream Connection Broker 9.0.34.3. Check the vendor advisory for mitigations.

References

https://dgccpa.com
https://gist.github.com/erud1te-sec/5c85924cb78ba85af42e0b7b62a5ec91
https://leostream.com
https://www.leostream.com/resources-2/product-lifecycle/
https://dgccpa.com
https://gist.github.com/erud1te-sec/5c85924cb78ba85af42e0b7b62a5ec91
https://leostream.com
https://www.leostream.com/resources-2/product-lifecycle/

Get alerted when CVE-2021-38157 or the next vulnerability affects your stack