Lucene search

TwcertCVELIST:CVE-2021-32542

HistoryMay 28, 2021 - 12:00 a.m.

CVE-2021-32542 SysJust CTS Web - Reflected XSS

2021-05-2800:00:00

CWE-79

twcert

www.cve.org

cts web

reflected xss

cve-2021-32542

security vulnerability

unfiltered parameters

connection token

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.

CNA Affected

[
  {
    "product": " CTS Web",
    "vendor": "SysJust",
    "versions": [
      {
        "lessThanOrEqual": "released 2021.3.25",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

www.twcert.org.tw/tw/cp-132-4758-82b05-1.html

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for CVELIST:CVE-2021-32542