CVE-2021-41467

MEDIUMNuclei

Cross-site scripting in application/controllers/dropbox.php in JustWriting

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2021-41467 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

hjue/justwriting

Browse Packagist / hjue/justwriting
GitHub AdvisoryThrough 1.0.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMJustWriting - Cross-Site ScriptingCVSS 6.1

A cross-site scripting vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorsmadrobot
Template tagscve2021cvejustwritingxssjustwriting_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:justwriting_project:justwriting:1.0.0:*:*:*:*:*:*:*
https://github.com/hjue/JustWriting/issues/106 https://nvd.nist.gov/vuln/detail/CVE-2021-41467 https://github.com/hjue/JustWriting/

Source: ProjectDiscovery

References

3