CVE-2021-40971

MEDIUMNuclei

Spotweb <= 1.5.1 - Cross Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-40971 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSpotweb <= 1.5.1 - Cross Site ScriptingCVSS 6.1

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Fixed in version 1.5.2

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2021cvexssspotwebspotweb_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:spotweb_project:spotweb:*:*:*:*:*:*:*:*
Shodan: title:"SpotWeb - overview"
Shodan: http.title:"spotweb - overview"
FOFA: title="spotweb - overview"
Google: intitle:"spotweb - overview"
https://github.com/spotweb/spotweb/ https://github.com/spotweb/spotweb/issues/711 https://nvd.nist.gov/vuln/detail/CVE-2021-40971 https://github.com/spotweb/spotweb

Source: ProjectDiscovery

References

3