CVE-2021-20116

2021-08-0520:38:27

tenable

www.cve.org

tcexam

cross-site scripting

vulnerability

session hijacking

administrator

unsantized output

EPSS

0.001

Percentile

37.3%

JSON

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim’s session or performing actions on their behalf.

CNA Affected

[
  {
    "product": "TCExam",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "<= 14.8.4"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2021-32

EPSS

0.001

Percentile

37.3%

JSON

Related for CVELIST:CVE-2021-20116