A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.
References
| Link | Resource |
|---|---|
| https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6 | Patch Third Party Advisory |
| https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941 | Patch Third Party Advisory |
| https://github.com/94fzb/zrlog/issues/56 | Patch Third Party Advisory |
Configurations
History
22 Jun 2021, 01:05
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
| References | (MISC) https://github.com/94fzb/zrlog/issues/56 - Patch, Third Party Advisory | |
| References | (MISC) https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6 - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941 - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:zrlog:zrlog:2.1.3:*:*:*:*:*:*:* |
15 Jun 2021, 20:38
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-15 20:15
Updated : 2024-02-04 21:47
NVD link : CVE-2020-21316
Mitre link : CVE-2020-21316
CVE.ORG link : CVE-2020-21316
JSON object : View
Products Affected
zrlog
- zrlog
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')