CVE-2021-30203

MEDIUMNuclei

Dzzoffice 2.02.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-30203 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTML.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 4, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHDzzoffice 2.02.1 - Cross-Site ScriptingCVSS 7.2

Dzzoffice 2.02.1_SC_UTF8 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the zero parameter.

Impact

Attackers can inject malicious JavaScript via XSS in the zero parameter, potentially stealing session cookies or performing unauthorized actions.

Remediation

Upgrade to Dzzoffice version 2.02.2 or later.

WeaknessesCWE-79
Authorsarafatansari
Template tagscvecve2021dzzofficexssvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:dzzoffice:dzzoffice:*:*:*:*:*:*:*:*
Shodan: http.html:"dzzoffice"
https://github.com/zyx0814/dzzoffice/issues/183 https://nvd.nist.gov/vuln/detail/CVE-2021-30203

Source: ProjectDiscovery

References

2