exploitDog

CVE-2021-35489

Опубликовано: 09 нояб. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

Ссылки

https://www.gruppotim.it/redteam
Exploit
Third Party Advisory
https://www.thruk.org/changelog.html
Release Notes
Vendor Advisory
https://www.gruppotim.it/redteam
Exploit
Third Party Advisory
https://www.thruk.org/changelog.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:thruk:thruk:2.40-2:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00401

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-6642-wv2w-7c29

github

больше 3 лет назад

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

EPSS

Процентиль: 60%

0.00401

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79