CVE-2021-21080: 
NixOS vulnerability analysis and mitigation

Adobe Connect version 11.0.7 and earlier versions are affected by a reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2021-21080. The vulnerability was discovered by security researcher Muhammed Ahmed (elpast) and was disclosed in March 2021 (Adobe Advisory).

The vulnerability is a reflected Cross-Site Scripting (XSS) issue that could allow an attacker to inject malicious JavaScript content. The CVSS v3.1 base score for this vulnerability is 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

If successfully exploited, the vulnerability could allow an attacker to execute malicious JavaScript code in the context of the victim's browser when they browse to a page containing the vulnerable field. This could potentially lead to the disclosure of sensitive information or manipulation of content displayed to users (NVD).

The vulnerability requires user interaction to be exploited, meaning a victim must voluntarily interact with a malicious payload. The attack can be conducted remotely over the network without requiring authentication (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Connect. The fix was included in the security bulletin APSB21-19 (Adobe Advisory).