CVE-2021-21043CWE-79

Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools

Medium · published February 2, 2021

CVSS v3.1
6.1
EPSS
3%
Percentile
88.6
In the wild
Unconfirmed
What it is

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.03337 · 88.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-02-02T22:29Z
EPSS history
Timeline
  • 02 FEB 22:29Z
    Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools
    cvelistv5