athosgonzaga/cve-2021-3030Advisory: Cute Editor 6.4 reflected XSS via 'Theme' parameter in colorpicker_more.aspx
CVE ID: CVE-2021-3030 Status: Reserved by the CVE Program (MITRE) on 2021-01-06. No public record has ever been published for this ID — this document is the public reference required to complete that publication. Vulnerability type: Cross-Site Scripting (XSS), Reflected — CWE-79 Discoverer: Athos Nogueira Gonzaga Vendor: CuteSoft (Cute Editor for ASP.NET) — https://cutesoft.net/ Affected version: Cute Editor 6.4 (the only version tested; other versions were not verified and may or may not be affected)
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper
validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated
attacker can craft a URL that, once opened by a victim in a browser session authenticated to a
site running the vulnerable component, executes arbitrary JavaScript in the security context of
that site.
/CuteSoft_Client/CuteEditor/Dialogs/colorpicker_more.aspx
Parameter: Theme
Payload (as submitted):
%27%20%20onmouseover=alert(document.domain)%20alt=%27
URL-decoded, the payload is:
' onmouseover=alert(document.domain) alt='
Example request:
GET /CuteSoft_Client/CuteEditor/Dialogs/colorpicker_more.aspx?Theme=%27%20%20onmouseover=alert(document.domain)%20alt=%27 HTTP/1.1
Host: <vulnerable-host>
The unsanitized Theme value is reflected into an HTML attribute context on the resulting page.
The injected onmouseover event handler fires when the victim interacts with the affected
element, executing alert(document.domain) — in a real attack, this would instead be replaced
with a payload to exfiltrate session cookies, forge in-page UI, or pivot to further
client-side attacks against the authenticated session.
Impact: Information Disclosure = true.| Date | Event |
|---|---|
| 2021-01-06 | Vulnerability reported to the CVE Program ([email protected]); CVE-2021-3030 assigned/reserved the same day. |
| 2021 (between assignment and the follow-up below) | Vendor (CuteSoft) contacted directly by the discoverer; no response was received. |
| 2022-01-27 | Discoverer followed up with the CVE Program, reporting the vendor's non-response and asking that disclosure/publication proceed. |
| 2026-04-08 | Discoverer followed up again, noting the CVE ID still had no public record and no credit associated with their name. |
| 2026-09-05 | Independent verification (this review) confirms the record was never published: the CVE Services API returns CVE_RECORD_DNE for CVE-2021-3030, and the ID does not appear in NVD or in any public CVE search. No unrelated public disclosure of this specific bug exists either — it is a distinct issue from other, unrelated CuteEditor CVEs (e.g. CVE-2012-2985 / VU#247235, a different bug in InsertDocument.aspx; and CVE-2020-24903, an unrelated 2016 Bugtraq-sourced report). This document is published to supply the missing public reference. |
A CVE ID reserved directly by MITRE (as this one was, via [email protected], before full
delegation to per-vendor CNAs) requires a public reference — a published write-up, advisory, or
proof of disclosure — before MITRE will populate the record and move it from RESERVED to
PUBLISHED. The original report's reference field pointed only to the vendor's general support
forum (https://cutesoft.net/forums/17/ShowForum.aspx), not to a dedicated public advisory
describing this specific bug — which is likely why the record was never finalized. This
repository is that missing public reference.
The vendor was contacted directly and did not respond. As of this publication (more than 5 years after the report and vendor contact attempt), no fix or vendor statement is known to exist. No newer version of Cute Editor has been verified against this specific issue.
Discovered and reported by Athos Nogueira Gonzaga.