CVE-2021-21800

MEDIUMNuclei

Advantech R-SeeNet 2.4.12 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-21800 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Advantech

CVE ListAdvantech R-SeeNet 2.4.12 (20.10.2020)affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAdvantech R-SeeNet 2.4.12 - Cross-Site ScriptingCVSS 6.1

Advantech R-SeeNet 2.4.12 contains a reflected cross-site scripting vulnerability in the ssh_form.php script functionality.

Impact

Attackers can inject malicious JavaScript via reflected XSS, potentially stealing administrator session cookies or performing administrative actions on behalf of authenticated users.

Remediation

Apply the latest security patches or updates provided by Advantech to fix the XSS vulnerability in R-SeeNet 2.4.12.

WeaknessesCWE-79
Authorsarafatansari
Template tagscve2021cvexssr-seenetadvantechvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*
Shodan: http.html:"R-SeeNet"
Shodan: http.html:"r-seenet"
FOFA: body="r-seenet"
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1271 https://nvd.nist.gov/vuln/detail/CVE-2021-21800 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates https://github.com/Live-Hack-CVE/CVE-2021-21800

Source: ProjectDiscovery

References

2