ByteOS Network

NVD Vulnerability Details :

CVE-2021-37365

Analyzed

Source-cve@mitre.org

Published At-10 Aug, 2021 | 17:15

Updated At-13 Aug, 2021 | 14:56

CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. In bl_categires_help.php, the 'categories' variable is assigned with the content of the query string param 'cat' without sanitization or encoding, enabling an attacker to inject malicious code into the output webpage.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

ctparental_project>>ctparental>>Versions before 4.45.03(exclusive)

cpe:2.3:a:ctparental_project:ctparental:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://gist.github.com/securylight/092ba96a660e07ad76f2a380c2eaa75a	cve@mitre.org	Third Party Advisory
https://gitlab.com/marsat/CTparental/	cve@mitre.org	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History