CVE-2021-42118CWE-79

Stored XSS in TopEase

High · published November 30, 2021

CVSS v3.1
8.1
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-30T11:28Z
EPSS history
Timeline
  • 30 NOV 11:28Z
    Stored XSS in TopEase
    cvelistv5