CVE-2021-42119CWE-79

Stored XSS in Search Function in TopEase

High · published November 30, 2021

CVSS v3.1
7.3
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00530 · 43.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-30T11:28Z
EPSS history
Timeline
  • 30 NOV 11:28Z
    Stored XSS in Search Function in TopEase
    cvelistv5