CVE-2021-37330

{"id": "CVE-2021-37330", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-04T14:15:07.393", "references": [{"url": "https://www.navidkagalwalla.com/booking-core-vulnerabilities", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS). The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar, an XSS will trigger."}, {"lang": "es", "value": "Laravel Booking System Booking Core versi\u00f3n 2.0, es vulnerable a un ataque de tipo Cross Site Scripting (XSS). La carga del avatar en la secci\u00f3n My Profile podr\u00eda ser explotada para cargar un archivo SVG malicioso que contiene Javascript. Ahora, si otro usuario/administrador visualiza el perfil y hace clic para visualizar su avatar, se desencadenar\u00e1 un ataque de tipo XSS"}], "lastModified": "2021-10-12T19:30:08.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bookingcore:booking_core:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9476082F-B54F-46BB-9016-DF83BC0CCA08"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}