CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.

CVSS v3 4.6 MEDIUM
CVSS v2.0 3.5 LOW

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html	Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:junhetec:enterprise_resource_planning_point_of_sale_system:2013.10:*:*:*:*:*:*:*

History

21 Nov 2024, 06:03

Type	Values Removed	Values Added
References	~~() https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html - Third Party Advisory~~	() https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html - Third Party Advisory
CVSS	v2 : ~~3.5~~ v3 : ~~5.4~~	v2 : 3.5 v3 : 4.6

Information

Published : 2021-05-07 10:15

Updated : 2024-11-21 06:03

NVD link : CVE-2021-30170

Mitre link : CVE-2021-30170

CVE.ORG link : CVE-2021-30170

JSON object : View

Products Affected

junhetec

enterprise_resource_planning_point_of_sale_system

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-30170", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-05-07T10:15:08.430", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-4707-9c87e-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Special characters of ERP POS customer profile page are not filtered in users\u2019 input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer\u2019s information."}, {"lang": "es", "value": "Los caracteres especiales de la p\u00e1gina de perfil de cliente de ERP POS no se filtran en la entrada de los usuarios, lo que permite a atacantes autenticados remotos poder inyectar JavaScript malicioso y ejecutar ataques de tipo XSS (Cross-site scripting) Almacenado, adem\u00e1s de acceder y manipular la informaci\u00f3n del cliente"}], "lastModified": "2024-11-21T06:03:27.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:junhetec:enterprise_resource_planning_point_of_sale_system:2013.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E635C622-D09C-423B-8800-05848E85C439"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}