CVE-2021-46447

Опубликовано: 28 янв. 2022

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.

Ссылки

https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
Exploit
Third Party Advisory
https://www.hhg-multistore.com/
Vendor Advisory
https://github.com/blockomat2100/PoCs/blob/main/hhg_multistore/exploit_hhg_multistore.md
Exploit
Third Party Advisory
https://www.hhg-multistore.com/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hhg-multistore:multistore:*:*:*:*:enterprise:*:*:*

Версия до 5.1.0 (включая)

cpe:2.3:a:hhg-multistore:multistore:4.10.3:*:*:*:community:*:*:*

EPSS

Процентиль: 65%

0.00502

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-2jg4-p688-m2mm

github

около 4 лет назад