CVE-2021-38707

{"id": "CVE-2021-38707", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-09-07T20:15:08.147", "references": [{"url": "https://github.com/judsonmitchell/ClinicCases/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/sudonoodle/CVE-2021-38707", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/judsonmitchell/ClinicCases/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/sudonoodle/CVE-2021-38707", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft."}, {"lang": "es", "value": "Unas vulnerabilidades persistentes de tipo cross-site scripting (XSS) en ClinicCases versi\u00f3n 7.3.3, permiten a atacantes pocos privilegiados introducir JavaScript arbitrario en los par\u00e1metros account. Las cargas \u00fatiles de tipo XSS ser\u00e1n ejecutadas en el navegador de cualquier usuario que visualice el contenido correspondiente. Esto puede resultar en una toma de posesi\u00f3n de la cuenta por medio del robo de tokens de sesi\u00f3n"}], "lastModified": "2024-11-21T06:17:57.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cliniccases:cliniccases:7.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B592D4CE-7412-48C9-9B52-08A0EF43FFFD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}