Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3944

23
FAUCET Score

CVE-2021-3944 describes a Cross-Site Request Forgery (CSRF) vulnerability affecting BookStack, specifically bookstackapp bookstack. This medium-severity vulnerability (CVSS 6.8) can be exploited remotely with high attack complexity, potentially leading to high impact on confidentiality and integrity if a user is tricked into performing an unintended action. There is currently no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community or media attention.

Impacted Technologies

VendorProductVersion(s)CPE
< 21.11CPE matchmatch criteria
cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

3.1LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.6
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
0.62%
Probability of exploitation in next 30 days
EPSS Percentile
46.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0062 is in the 62nd percentile among its peer group of 705 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa
Product: ssddanbrown/bookstackFixed in: 21.11
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-wc7v-77jr-5c3mlow

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)

Dec 3, 2021

References

github.com / bookstackapp/bookstack/commit/88e6f93abf54192a69cc8080e0dc6516ee68ccbb
PatchThird Party Advisory
huntr.dev / bounties/65551490-5ade-49aa-8b8d-274c2ca9fdc9
ExploitPatchThird Party Advisory