CVE-2020-21316

Опубликовано: 15 июн. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.

Ссылки

https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6
Patch
Third Party Advisory
https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941
Patch
Third Party Advisory
https://github.com/94fzb/zrlog/issues/56
Patch
Third Party Advisory
https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6
Patch
Third Party Advisory
https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941
Patch
Third Party Advisory
https://github.com/94fzb/zrlog/issues/56
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zrlog:zrlog:2.1.3:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00632

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-mwq9-wcfh-9w35

github

больше 3 лет назад