CVE-2021-37573

MEDIUMNuclei

Tiny Java Web Server - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-37573 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMTiny Java Web Server - Cross-Site ScriptingCVSS 6.1

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Apply the latest security patches or updates provided by the vendor to fix this vulnerability.

WeaknessesCWE-79
Authorsgeeknik
Template tagscve2021cvexsstjwsjavasecliststiny_java_web_server_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:tiny_java_web_server_project:tiny_java_web_server:*:*:*:*:*:*:*:*
https://seclists.org/fulldisclosure/2021/Aug/13 https://nvd.nist.gov/vuln/detail/CVE-2021-37573 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-042.txt http://seclists.org/fulldisclosure/2021/Aug/13 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4