CVE-2021-34370

MEDIUMNuclei

Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-34370 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBAccela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)ExploitDB exploitby Abdulazeez AlaseeriNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMAccela Civic Platform <=21.1 - Cross-Site ScriptingCVSS 6.1

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via ssoAdapter/logoutAction.do successURL.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected application.

Remediation

Upgrade to a patched version of Accela Civic Platform (version >21.1) that includes proper input validation and sanitization.

WeaknessesCWE-79
Authors0x_Akoko
Template tagscvecve2021xssredirectaccelaedbvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:accela:civic_platform:*:*:*:*:*:*:*:*
https://www.exploit-db.com/exploits/49990 https://www.accela.com/civic-platform/ https://gist.github.com/0xx7/7e9f1b725f7ff98b9239d3cb027b7dc8 https://nvd.nist.gov/vuln/detail/CVE-2021-34370 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3