CVE-2021-41918

{"id": "CVE-2021-41918", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-08T16:15:08.293", "references": [{"url": "https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page."}, {"lang": "es", "value": "webTareas versiones 2.4 y anteriores, permiten a un usuario autenticado inyectar script web o HTML arbitrario debido a un incorrecto saneamiento de los datos suministrados por el usuario y lograr un ataque de Cross-Site Scripting reflejado contra los usuarios y administradores de la plataforma. El problema afecta a todos los endpoints de la aplicaci\u00f3n porque est\u00e1 relacionado con la forma en que se devuelve cada URL en cada p\u00e1gina de respuesta"}], "lastModified": "2024-11-21T06:26:57.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webtareas_project:webtareas:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D14F9631-6428-45A8-99D1-03BBEC82E87E", "versionEndIncluding": "2.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}