CVE-2021-20673

2021-03-1009:20:35

jpcert

www.cve.org

vulnerability

cross-site scripting

growi

admin page

remote attackers

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

29.2%

JSON

Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.

CNA Affected

[
  {
    "product": "GROWI (v4.2 Series)",
    "vendor": "WESEEK, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "versions from v4.2.0 to v4.2.7"
      }
    ]
  }
]