CVE-2021-3340

Опубликовано: 01 фев. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php?action=initLogon or modules/admin/DELETEIMAGES.php.

Ссылки

https://sourceforge.net/p/wikindx/news/2021/01/wikindx-v641-released/
Release Notes
Third Party Advisory
https://sourceforge.net/projects/wikindx/
Product
Third Party Advisory
https://sourceforge.net/p/wikindx/news/2021/01/wikindx-v641-released/
Release Notes
Third Party Advisory
https://sourceforge.net/projects/wikindx/
Product
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:wikindx_project:wikindx:*:*:*:*:*:*:*:*

Версия до 5.7.0 (исключая)

cpe:2.3:a:wikindx_project:wikindx:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.4.0 (включая)

EPSS

Процентиль: 53%

0.00304

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-hhm3-x3q6-2xcg

github

больше 3 лет назад