CVE-2021-44082

Опубликовано: 29 мар. 2022

Источник: nvd

CVSS3: 8.3

CVSS2: 5.1

EPSS Низкий

Описание

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.

Ссылки

https://pentest.co.uk/labs/leveraging-xss-to-get-rce-in-textpattern/
Exploit
Third Party Advisory
https://www.cornerpirate.com
Not Applicable
https://www.pentest.co.uk
Third Party Advisory
https://pentest.co.uk/labs/leveraging-xss-to-get-rce-in-textpattern/
Exploit
Third Party Advisory
https://www.cornerpirate.com
Not Applicable
https://www.pentest.co.uk
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:textpattern:textpattern:4.8.7:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03477

Низкий

8.3 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2021-44082

CVSS3: 8.3

debian

почти 4 года назад

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /tex ...

GHSA-44jp-4j2r-4c78

CVSS3: 8.3

github

почти 4 года назад

EPSS

Процентиль: 87%

0.03477

Низкий

8.3 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-79