CVE-2021-35489

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter

published November 9, 2021

CVSS
—
EPSS
1%
Percentile
58.1
In the wild
Unconfirmed
What it is

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00861 · 58.1th percentile
Published
2021-11-09T22:28Z
EPSS history
Timeline
  • 09 NOV 22:28Z
    Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter
    cvelistv5