Lucene search

[email protected]CVE-2021-41567

HistoryOct 08, 2021 - 4:15 p.m.

CVE-2021-41567

2021-10-0816:15:08

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-41567

tad uploader

book list

filter

special characters

unauthenticated

remote

javascript

xss

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.

Affected configurations

NVD

Node

tad_uploader_projecttad_uploaderRange<3.5.4

CPENameOperatorVersion
tad_uploader_project:tad_uploadertad uploader project tad uploaderlt3.5.4

CPE	Name	Operator	Version
tad_uploader_project:tad_uploader	tad uploader project tad uploader	lt	3.5.4

CNA Affected

[
  {
    "product": "Uploader",
    "vendor": "Tad",
    "versions": [
      {
        "lessThanOrEqual": "3.5.3",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-5171-64439-1.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

Related for CVE-2021-41567

prion1 cvelist1 nvd1