ByteOS Network

NVD Vulnerability Details :

CVE-2021-40238

Analyzed

Source-cve@mitre.org

Published At-15 Sep, 2021 | 17:15

Updated At-28 Sep, 2021 | 15:44

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

webuzo>>webuzo>>Versions before 2.9.0(exclusive)

cpe:2.3:a:webuzo:webuzo:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e	cve@mitre.org	Third Party Advisory
https://www.webuzo.com/blog/webuzo-2-9-0-launched/	cve@mitre.org	Release Notes Vendor Advisory

Hyperlink: https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.webuzo.com/blog/webuzo-2-9-0-launched/

Source: cve@mitre.org

Resource:

Release Notes

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History