Lucene search

NCSC.chCVE-2021-42119

HistoryNov 30, 2021 - 12:15 p.m.

CVE-2021-42119

2021-11-3012:15:07

CWE-79

NCSC.ch

web.nvd.nist.gov

cve-2021-42119

persistent xss

web applications

business-dna solutions gmbh

topease® platform

search functionality

object modification privileges

html

javascript

security vulnerability

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

22.7%

JSON

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

Affected configurations

Nvd

Node

businessdnasolutionstopeaseRange≤7.1.27

VendorProductVersionCPE
businessdnasolutionstopease*cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
businessdnasolutions	topease	*	cpe:2.3:a:businessdnasolutions:topease::::::::

CNA Affected

[
  {
    "product": "TopEase",
    "vendor": "Business-DNA Solutions GmbH",
    "versions": [
      {
        "lessThanOrEqual": "7.1.27",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

confluence.topease.ch/confluence/display/DOC/Release+Notes

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2021-42119