CVE-2021-41318
MEDIUMProgress WhatsUp Gold < 21.1.0 - Unauthenticated Stored Cross-Site Scripting
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-41318. PoCs published by Andreas Finstad.
AI-analyzed exploit summary This exploit demonstrates a stored XSS vulnerability in WhatsUpGold 21.0.3, where an SNMP device's sysContact field is manipulated to inject a malicious script. The script fetches and executes a remote JavaScript payload that creates a new administrator account via an unauthenticated API call.
Description
In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Exploits (1)
This exploit demonstrates a stored XSS vulnerability in WhatsUpGold 21.0.3, where an SNMP device's sysContact field is manipulated to inject a malicious script. The script fetches and executes a remote JavaScript payload that creates a new administrator account via an unauthenticated API call.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N