Lucene search

NCSC.chCVE-2021-42118

HistoryNov 30, 2021 - 12:15 p.m.

CVE-2021-42118

2021-11-3012:15:07

CWE-79

NCSC.ch

web.nvd.nist.gov

cve-2021-42118

cross site scripting

web applications

business-dna solutions

topease® platform

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

Affected configurations

Nvd

Node

businessdnasolutionstopeaseRange≤7.1.27

VendorProductVersionCPE
businessdnasolutionstopease*cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
businessdnasolutions	topease	*	cpe:2.3:a:businessdnasolutions:topease::::::::

CNA Affected

[
  {
    "product": "TopEase",
    "vendor": "Business-DNA Solutions GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.1.27",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

confluence.topease.ch/confluence/display/DOC/Release+Notes

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Related for CVE-2021-42118