Lucene search

SymantecCVE-2021-30650

HistoryFeb 18, 2022 - 6:15 p.m.

CVE-2021-30650

2022-02-1818:15:09

CWE-79

symantec

web.nvd.nist.gov

cve-2021-30650

reflected xss

symantec

layer7

api management

oauth toolkit

otk

remote attackers

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.7%

JSON

A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious code into the OTK web UI client application.

Affected configurations

Nvd

Node

broadcomlayer7_api_management_oauth_toolkitRange<4.4.1

VendorProductVersionCPE
broadcomlayer7_api_management_oauth_toolkit*cpe:2.3:a:broadcom:layer7_api_management_oauth_toolkit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
broadcom	layer7_api_management_oauth_toolkit	*	cpe:2.3:a:broadcom:layer7_api_management_oauth_toolkit::::::::

CNA Affected

[
  {
    "product": "Layer7 API Management OAuth Toolkit (OTK)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "OTK 4.4.x and earlier"
      }
    ]
  }
]

References

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/CVE-2021-30650-Layer7-OAuth-Toolkit-OTK-/20170

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.7%

JSON

Related for CVE-2021-30650