Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
References
Link | Resource |
---|---|
https://crocoblock.com/changelog/?plugin=jet-engine | Release Notes Vendor Advisory |
https://crocoblock.com/plugins/jetengine/ | Product |
Configurations
History
23 Aug 2021, 18:12
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 | |
References | (MISC) https://crocoblock.com/plugins/jetengine/ - Product | |
References | (CONFIRM) https://crocoblock.com/changelog/?plugin=jet-engine - Release Notes, Vendor Advisory | |
CPE | cpe:2.3:a:crocoblock:jetengine:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
16 Aug 2021, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-08-16 13:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-38607
Mitre link : CVE-2021-38607
CVE.ORG link : CVE-2021-38607
JSON object : View
Products Affected
crocoblock
- jetengine
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')