CVE-2021-21442CWE-79
XSS vulnerability in Time Accounting
Medium · published July 26, 2021
What it is
In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19.
The record
Technical detail
- CVSS v3.1
- 4.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00603 · 48.2th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2021-07-26T04:25Z
EPSS history
Timeline