CVE-2021-26475

MEDIUMNuclei

EPrints 3.4.2 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-26475 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMEPrints 3.4.2 - Cross-Site ScriptingCVSS 6.1

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability via the cgi/cal URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or upgrade to a newer version of EPrints that addresses this vulnerability.

WeaknessesCWE-79
Authorsgeeknik
Template tagscve2021cvexsseprintsintrusivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:eprints:eprints:3.4.2:*:*:*:*:*:*:*
https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf https://files.eprints.org/2548/ https://nvd.nist.gov/vuln/detail/CVE-2021-26475 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3