PatchSiren

PatchSiren cyber security CVE debrief

CVE-2021-44197 UBIT Information Technologies CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in UBIT Information Technologies Student Information Management System versions prior to 20211126. The flaw stems from improper neutralization of script-related HTML tags in web page content, allowing attackers to inject malicious scripts that execute in victims' browsers. With a CVSS 3.1 score of 6.1 (MEDIUM), this vulnerability requires network access and user interaction but can compromise session credentials or perform unauthorized actions on behalf of authenticated users. The Turkish National Cyber Security Incident Response Team (USOM) published advisory TR-23-0131 documenting this issue. Organizations should upgrade to version 20211126 or later and implement Content Security Policy headers and input validation as defense-in-depth measures.

Vendor
UBIT Information Technologies
Product
Student Information Management System
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2023-03-07
Original CVE updated
2026-05-18
Advisory published
2023-03-07
Advisory updated
2026-05-18

Who should care

Organizations operating UBIT Student Information Management System, particularly educational institutions using this platform for student data management. Security teams responsible for web application security and compliance with data protection regulations.

Technical summary

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page). The affected product is UBIT Student Information Management System with versions prior to 20211126 being vulnerable. The attack vector is network-based with low complexity, requiring no privileges but user interaction. Successful exploitation allows script injection with scope change impact, affecting confidentiality and integrity at low severity with no availability impact.

Defensive priority

medium

Recommended defensive actions

  • Upgrade UBIT Student Information Management System to version 20211126 or later
  • Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Apply context-aware output encoding for all user-supplied content
  • Review and strengthen input validation on all web form fields
  • Monitor for suspicious script injection attempts in application logs

Evidence notes

Vulnerability affects Student Information Management System versions before 20211126 per NVD CPE criteria. USOM advisory TR-23-0131 provides third-party confirmation. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-based attack with low complexity, no privileges required, user interaction needed, scope change, and low impact to confidentiality and integrity.

Sources and references

Verified primary and authoritative sources

  • CVE-2021-44197 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2021-44197

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2021-44197 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2021-44197

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.