CVE-2021-23260CWE-79

Stored XSS Vulnerability in File Name of the File Upload function

Medium · published December 2, 2021

CVSS v3.1
6.5
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-12-02T15:40Z
EPSS history
Timeline
  • 02 DEC 15:40Z
    Stored XSS Vulnerability in File Name of the File Upload function
    cvelistv5