CVE-2021-40094: 
SquaredUp vulnerability analysis and mitigation

A DOM-based XSS vulnerability (CVE-2021-40094) was discovered in SquaredUp for SCOM version 5.2.1.6654 and earlier versions. The vulnerability was disclosed on December 7, 2021, affecting multiple editions including SCOM Edition, Azure Edition, and Community Edition. This security issue was reported by Kajetan Rostojek from ING Tech Poland (Vendor Advisory).

The vulnerability is classified as a DOM-based stored cross-site scripting issue that affects the browsercheck function. The CVSS v3.1 base score is 5.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If successfully exploited, this vulnerability could allow attackers to inject malicious code into a user's device, potentially leading to unauthorized access to user data and compromise of the user's browser session (Vendor Advisory).

The vulnerability was fixed in SquaredUp version 5.3.1 by improving the browsercheck function to prevent DOM-based XSS. Users running versions earlier than 5.3.1 are advised to upgrade to version 5.3.1 or later to address this security issue (Vendor Advisory).