Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags.
References
| Link | Resource |
|---|---|
| https://seclists.org/fulldisclosure/2021/Jul/20 | Mailing List Third Party Advisory |
| https://seclists.org/fulldisclosure/2021/Jul/20 | Mailing List Third Party Advisory |
Configurations
History
21 Nov 2024, 06:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://seclists.org/fulldisclosure/2021/Jul/20 - Mailing List, Third Party Advisory |
28 Jul 2021, 17:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.1 |
| References | (FULLDISC) https://seclists.org/fulldisclosure/2021/Jul/20 - Mailing List, Third Party Advisory | |
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:aat:novus_management_system:*:*:*:*:*:*:*:* |
19 Jul 2021, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-19 18:15
Updated : 2024-11-21 06:11
NVD link : CVE-2021-34821
Mitre link : CVE-2021-34821
CVE.ORG link : CVE-2021-34821
JSON object : View
Products Affected
aat
- novus_management_system
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')