CVE-2021-44082

2022-03-2923:15:07

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.5%

JSON

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.

CPENameOperatorVersion
textpatterneq4.6.2
textpatterneq4.7.0-beta
textpatterneq4.7.3
textpatterneq4.6.0-beta
textpatterneq4.7.0-beta.2
textpatterneq4.8.0-beta.3
textpatterneq4.3.0
textpatterneq4.8.5
textpatterneq4.6.0
textpatterneq4.6.0-beta.3

Name	Operator	Version
textpattern	eq	4.6.2
textpattern	eq	4.7.0-beta
textpattern	eq	4.7.3
textpattern	eq	4.6.0-beta
textpattern	eq	4.7.0-beta.2
textpattern	eq	4.8.0-beta.3
textpattern	eq	4.3.0
textpattern	eq	4.8.5
textpattern	eq	4.6.0
textpattern	eq	4.6.0-beta.3