How severe is CVE-2021-37788?

CVE-2021-37788 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2021-37788 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-37788?

CVE-2021-37788 affects Gurock Testrail. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-37788?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-37788 published?

CVE-2021-37788 was published on 2021-08-09 and last updated on 2026-06-17.

CVE-2021-37788

CVE-2021-37788 is a medium-severity vulnerability in Gurock Testrail with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1021.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
CVSS v2: 4.3
EPSS exploit prediction: 2% (72nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1021
Affected product: Gurock Testrail
Published: 2021-08-09
Last modified: 2026-06-17

Description

A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.

Frequently asked questions

What is CVE-2021-37788?: A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.
How severe is CVE-2021-37788?: CVE-2021-37788 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2021-37788 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-37788?: CVE-2021-37788 affects Gurock Testrail. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-37788?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-37788 published?: CVE-2021-37788 was published on 2021-08-09 and last updated on 2026-06-17.

References

https://gist.github.com/rvismit/67bc11dd9ccb7423827564cb81d25740

Affected products (1)

cpe:2.3:a:gurock:testrail:5.3.0.3603:*:*:*:*:*:*:*

More vulnerabilities in Gurock Testrail

CVE-2018-20063 — High (CVSS 8.8): An issue was discovered in Gurock TestRail 5.6.0.3853. An "Unrestricted Upload of File" vulnerability exists in the…
CVE-2021-40875 — High (CVSS 7.5): Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat…
CVE-2021-36538 — Medium (CVSS 5.4): Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run…
CVE-2021-44263 — Medium (CVSS 5.4): Gurock TestRail before 7.2.4 mishandles HTML escaping.
CVE-2019-7535 — Medium (CVSS 5.3): index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as…
CVE-2014-4857 — Medium (CVSS 4.3): Cross-site scripting (XSS) vulnerability in Gurock TestRail before 3.1.3 allows remote attackers to inject arbitrary…

All CVEs affecting Gurock Testrail →

Other CWE-1021 vulnerabilities

CVE-2021-43048 — Critical (CVSS 9.8): The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability…
CVE-2021-23274 — Critical (CVSS 9.8): The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution…
CVE-2016-2496 — Critical (CVSS 9.8): The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct…
CVE-2021-21132 — Critical (CVSS 9.6): Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to…
CVE-2021-21111 — Critical (CVSS 9.6): Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a…
CVE-2024-10004 — Critical (CVSS 9.1): Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in…

Browse all CWE-1021 vulnerabilities →