CVE-2021-36450

MEDIUMNuclei

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-36450 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMVerint Workforce Optimization 15.2.8.10048 - Cross-Site ScriptingCVSS 6.1

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/my_notifications NEWUINAV parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Apply the latest security patch or upgrade to a non-vulnerable version of Verint Workforce Optimization.

WeaknessesCWE-79
Authorsatomiczsec
Template tagscve2021cvexssverintvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:verint:workforce_optimization:15.2.8.10048:*:*:*:*:*:*:*
Shodan: title:"Verint Sign-in"
Shodan: http.title:"verint sign-in"
FOFA: title="verint sign-in"
Google: intitle:"verint sign-in"
https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740 https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html http://verint.com/ https://nvd.nist.gov/vuln/detail/CVE-2021-36450 https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740

Source: ProjectDiscovery

References

5