CVE-2021-42119

{"id": "CVE-2021-42119", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "published": "2021-11-30T12:15:07.863", "references": [{"url": "https://confluence.topease.ch/confluence/display/DOC/Release+Notes", "tags": ["Release Notes", "Vendor Advisory"], "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH\u2019s TopEase\u00ae Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover."}, {"lang": "es", "value": "Un ataque de tipo Cross Site Scripting Persistente en aplicaciones web que operan en la plataforma TopEase\u00ae de Business-DNA Solutions GmbH, versiones anteriores a 7.1.27 incluy\u00e9ndola, por medio de la Funcionalidad Search, permite a usuarios autenticados con privilegios de modificaci\u00f3n de objetos inyectar HTML y JavaScript arbitrarios en los atributos de los objetos, que luego se renderizan en la funcionalidad de b\u00fasqueda, para alterar la funcionalidad prevista y robar cookies, lo que permite la toma de posesi\u00f3n de la cuenta"}], "lastModified": "2023-11-07T03:39:07.077", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:businessdnasolutions:topease:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5586486C-6AB4-4357-A17C-7957140EAB27", "versionEndIncluding": "7.1.27"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@ncsc.ch"}