CVE-2021-33904

MEDIUMNuclei

Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-33904 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBAccela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)ExploitDB exploitby Abdulazeez AlaseeriNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMAccela Civic Platform <=21.1 - Cross-Site ScriptingCVSS 6.1

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of Accela Civic Platform (version >21.1) that includes proper input validation to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsgeeknik
Template tagscvecve2021accelaxssedbpacketstormvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/49980 https://gist.github.com/0xx7/3d934939d7122fe23db11bc48eda9d21 http://packetstormsecurity.com/files/163093/Accela-Civic-Platorm-21.1-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2021-33904 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3