CVE-2021-32542CWE-79

SysJust CTS Web - Reflected XSS

Medium · published May 28, 2021

CVSS v3.1
4.7
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-05-28T08:10Z
EPSS history
Timeline
  • 28 MAY 08:10Z
    SysJust CTS Web - Reflected XSS
    cvelistv5