Lucene search

[email protected]CVE-2021-38619

HistoryAug 13, 2021 - 3:15 p.m.

CVE-2021-38619

2021-08-1315:15:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2021-38619

openbaraza hcm

xss

vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.5%

JSON

openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).

CPENameOperatorVersion
openbaraza:openbaraza_human_capital_managementopenbaraza openbaraza human capital managementeq3.1.6

CPE	Name	Operator	Version
openbaraza:openbaraza_human_capital_management	openbaraza openbaraza human capital management	eq	3.1.6

References

github.com/charlesbickel/CVE-2021-38619

openbaraza.org/

sourceforge.net/projects/obhrms/

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

49.5%

JSON

Related for CVE-2021-38619

githubexploit1 prion1 cvelist1