A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
References
Link | Resource |
---|---|
https://www.tenable.com/security/research/tra-2021-32 | Exploit Third Party Advisory |
https://www.tenable.com/security/research/tra-2021-32 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:45
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.tenable.com/security/research/tra-2021-32 - Exploit, Third Party Advisory |
Information
Published : 2021-08-05 21:15
Updated : 2024-11-21 05:45
NVD link : CVE-2021-20116
Mitre link : CVE-2021-20116
CVE.ORG link : CVE-2021-20116
JSON object : View
Products Affected
tecnick
- tcexam
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')