Lucene search

TwcertCVELIST:CVE-2021-32542

HistoryMay 28, 2021 - 12:00 a.m.

CVE-2021-32542 SysJust CTS Web - Reflected XSS

2021-05-2800:00:00

CWE-79

twcert

www.cve.org

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

30.8%

JSON

The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.

CNA Affected

[
  {
    "product": " CTS Web",
    "vendor": "SysJust",
    "versions": [
      {
        "lessThanOrEqual": "released 2021.3.25",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

www.twcert.org.tw/tw/cp-132-4758-82b05-1.html

4.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for CVELIST:CVE-2021-32542