CVE-2021-4035CWE-79

Wocu Monitoring stored Cross-Site Scripting (XSS)

Low · published February 11, 2022

CVSS v3.1
3.5
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-11T17:40Z
EPSS history
Timeline
  • 11 FEB 17:40Z
    Wocu Monitoring stored Cross-Site Scripting (XSS)
    cvelistv5