CVE-2021-31930: Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated

Q: How do I fix CVE-2021-31930?

concerto: upgrade to newer than 2.3.6. Exact commands for each OS are on this page.

Q: Is CVE-2021-31930 being exploited?

CVE-2021-31930 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-31930 affect?

CVE-2021-31930 affects concerto. Severity is medium (CVSS 6.1). Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon reg

Q: How urgent is CVE-2021-31930?

Priority 36/100. No elevated risk signals yet.

Routine

MEDIUM 6.1UPGRADE

CVE-2021-31930 is a medium-severity flaw (CVSS 6.1) affecting concerto. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.9% (top 40%)
CISA exploited list	No
Weakness	CWE-79
Published	2021-05-19
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: concerto-signage

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-05-19 15:15 UTCPublished CVE record published
2026-06-17 03:52 UTCUpdated Record last modified

concerto-signage concerto UPGRADE

Affected: <= 2.3.6

Fixed in: newer than 2.3.6

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy concerto || rpm -q concerto || concerto --version

2. UPGRADE to newer than 2.3.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade concerto

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade concerto

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-31930?

concerto: upgrade to newer than 2.3.6. Exact commands for each OS are on this page.

Is CVE-2021-31930 being exploited?

CVE-2021-31930 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-31930 affect?

CVE-2021-31930 affects concerto. Severity is medium (CVSS 6.1). Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon reg

How urgent is CVE-2021-31930?

Priority 36/100. No elevated risk signals yet.

Related CVEs

CVE-2025-34027 CRITICAL 9.0 UPGRADE The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reve
CVE-2025-34025 HIGH 8.8 DOWNGRADE The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escap
CVE-2025-34026 HIGH 7.5 EXPLOITED UPGRADE Versa Concerto Improper Authentication Vulnerability

References

← Back to latest CVEs