CVE-2021-20137

MEDIUMNuclei

Gryphon Tower - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-20137 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Gryphon Tower router

CVE List<= 04.0004.12 (Current)affected

Nuclei templates

1
ProjectDiscoveryMEDIUMGryphon Tower - Cross-Site ScriptingCVSS 6.1

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/site_access/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the victim's browser.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorsedoardottt
Template tagscve2021cvexsstenablegryphongryphonconnectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:h:gryphonconnect:gryphon_tower:-:*:*:*:*:*:*:*
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20137 https://www.tenable.com/security/research/tra-2021-51 https://nvd.nist.gov/vuln/detail/CVE-2021-20137 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2