CVE-2021-37540
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIn JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceJetBrains Hub versions prior to 2021.1.13262 contained an insufficient Content Security Policy (CSP) for the Widget deployment feature. This CSP weakness could allow content injection or XSS attacks via the Widget functionality, which aligns with the medium severity CVSS rating.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 2021.1.13262CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify JetBrains Hub installed versionAccess the Hub administration interface or check the product version from the startup logs, typically found in the Hub installation directory or via the /about endpointAffected if version is below 2021.1.13262
-
Determine if Widget deployment feature is enabledReview the Hub administration console or configuration files for Widget module settings; check if any Widgets have been deployed or if the Widget functionality is active in the instanceAffected if Widget deployment feature is enabled or Widgets are configured
-
Inspect CSP headers for Widget endpointsUse browser developer tools or a command-line HTTP client to request a Widget-related URL (such as /hub/widget/* or similar Widget-serving paths) and examine the Content-Security-Policy response headerAffected if CSP header is absent, missing restrictions on script-src or default-src, or permits unsafe-inline/unsafe-eval for Widget content
-
Review CSP policy sourceExamine Hub configuration files (such as hub-config.properties or similar) or the web server configuration that serves Hub for the defined CSP policy valuesAffected if CSP policy does not include strict source restrictions or is not defined for the Widget feature area
User is affected if running any JetBrains Hub version prior to 2021.1.13262 with the Widget deployment feature enabled and without strict CSP protections in place for Widget content.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor data2021.1.13262
Upgrade JetBrains Hub to version 2021.1.13262 or later to obtain the patched CSP. If immediate upgrade is not possible, consider adding additional CSP headers or restrictions for the Widget deployment feature as a compensating control.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2021-37540 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2021-37540 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data