CVE-2021-26702

MEDIUMNuclei

EPrints 3.4.2 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-26702 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMEPrints 3.4.2 - Cross-Site ScriptingCVSS 6.1

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset_ dictionary URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patches or upgrade to a newer version of EPrints that addresses this vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscve2021cvexsseprintsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:eprints:eprints:3.4.2:*:*:*:*:*:*:*
https://github.com/grymer/CVE/blob/master/eprints_security_review.pdf https://files.eprints.org/2548/ https://nvd.nist.gov/vuln/detail/CVE-2021-26702 https://github.com/ARPSyndicate/kenzer-templates https://github.com/grymer/CVE

Source: ProjectDiscovery

References

3