CVE-2021-20840

Опубликовано: 24 нояб. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.

Ссылки

https://jvn.jp/en/jp/JVN68066589/index.html
Third Party Advisory
https://saasproject.net/ja/fixed/20211019.php
Vendor Advisory
https://wordpress.org/plugins/booking-package/
Product
https://jvn.jp/en/jp/JVN68066589/index.html
Third Party Advisory
https://saasproject.net/ja/fixed/20211019.php
Vendor Advisory
https://wordpress.org/plugins/booking-package/
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:saasproject:booking_package:*:*:*:*:*:wordpress:*:*

Версия до 1.5.11 (исключая)

EPSS

Процентиль: 71%

0.00668

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-6wcx-352r-rcj5