CVE-2021-20672

2021-03-1009:20:34

jpcert

www.cve.org

cross-site scripting

vulnerability

growi security

EPSS

0.001

Percentile

47.1%

JSON

Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.

CNA Affected

[
  {
    "product": "GROWI (v4.2 Series)",
    "vendor": "WESEEK, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "versions from v4.2.0 to v4.2.7"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN86438134/index.html

weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/

EPSS

0.001

Percentile

47.1%

JSON

Related for CVELIST:CVE-2021-20672