CVE-2021-21494

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter

published January 4, 2021

CVSS
—
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Published
2021-01-04T02:05Z
EPSS history
Timeline
  • 04 JAN 02:05Z
    MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter
    cvelistv5