Cross site scripting

2021-05-2808:15:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the usersâ€™ connection token that triggered the attack.

CPENameOperatorVersion
cts_weblt2021.3.24

CPE	Name	Operator	Version
	cts_web	lt	2021.3.24

References

www.chtsecurity.com/news/40e165e2-e539-49bc-bcf1-e3b27c29e344

www.twcert.org.tw/tw/cp-132-4758-82b05-1.html