Japan Vulnerability NotesJVN:53910556JVN#53910556: Multiple cross-site scripting vulnerabilities in multiple PHP Factory products
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
39.6%
Multiple products provided by PHP Factory contain multiple cross-site scripting vulnerabilities listed below.
Reflected cross-site scripting vulnerability (CWE-79) - CVE-2021-20723
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N | Base Score: 4.7 |
| CVSS v2 | AV:N/AC:H/Au:N/C:N/I:P/A:N | Base Score: 2.6 |
Reflected cross-site scripting vulnerability in the admin page (CWE-79) - CVE-2021-20724
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | Base Score: 6.1 |
| CVSS v2 | AV:N/AC:H/Au:N/C:N/I:P/A:N | Base Score: 2.6 |
Reflected cross-site scripting vulnerability in the admin page (CWE-79) - CVE-2021-20725
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | Base Score: 6.1 |
| CVSS v2 | AV:N/AC:H/Au:N/C:N/I:P/A:N | Base Score: 2.6 |
Impact
- An arbitrary script may be executed on the user’s web browser - CVE-2021-20723
- An arbitrary script may be executed on the logged-in user’s web browser - CVE-2021-20724, CVE-2021-20725
Solution
Update the software
Update to the latest version according to the information provided by the developer.
Add code to the affected file
In situations where updating the software is difficult, add code to the affected file according to the information provided by the developer.
Products Affected
CVE-2021-20723
-
[MailForm01] free edition versions which the last updated date listed at the top of descriptions in the program file is from December 12, 2014 to July 27, 2018.
CVE-2021-20724 -
[Telop01] free edition ver1.0.1 and earlier
CVE-2021-20725 -
[Calendar01] free edition ver1.0.1 and earlier
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
39.6%