CVE-2021-41951

MEDIUMNuclei

montala resourcespace Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2021-41951 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 31, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

resourcespace

Browse montala / resourcespace
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMResourcespace - Cross-Site ScriptingCVSS 6.1

ResourceSpace before 9.6 rev 18290 is affected by a reflected cross-site scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

To remediate this issue, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

WeaknessesCWE-79
Authorscoldfish
Template tagscve2021cvexssresourcespacemontalavkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:montala:resourcespace:*:*:*:*:*:*:*:*
https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/ https://nvd.nist.gov/vuln/detail/CVE-2021-41951 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates https://github.com/nvn1729/advisories

Source: ProjectDiscovery

References

2