CVE-2021-41318CWE-79cross-site-scripting

CVE-2021-41318

Medium · published September 28, 2021

CVSS v3.1
6.1
EPSS
6%
Percentile
93.2
In the wild
Unconfirmed
What it is

In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.05881 · 93.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-28T22:15Z
Affected products (1)
ProductVersionsFixed in
progress/whatsup_gold< 21.1.021.1.0
References (4)
http://packetstormsecurity.com/files/164359/WhatsUpGold-21.0.3-Cross-Site-Scripting.html · [email protected]https://knowledgebase.progress.com/articles/Knowledge/WhatsUp-Gold-Security-Bulletin-September-2021 · [email protected]http://packetstormsecurity.com/files/164359/WhatsUpGold-21.0.3-Cross-Site-Scripting.html · af854a3a-2127-422b-91ae-364da2661108https://knowledgebase.progress.com/articles/Knowledge/WhatsUp-Gold-Security-Bulletin-September-2021 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 SEP 17:40Z
    In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input
    cvelistv5