CVE-2021-42329

{"id": "CVE-2021-42329", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-15T12:15:07.570", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-5199-61238-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-5199-61238-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The \u201cList_Add\u201d function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attacks."}, {"lang": "es", "value": "La funci\u00f3n \"List_Add\" del tablero de mensajes de ShinHer StudyOnline System no filtra los caracteres especiales en el par\u00e1metro title. Despu\u00e9s de iniciar sesi\u00f3n con privilegios de usuario, unos atacantes remotos pueden inyectar JavaScript y ejecutar ataques de tipo XSS almacenados"}], "lastModified": "2024-11-21T06:27:37.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xinheinformation:xinhe_teaching_platform_system:v2021:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E91C6E5-D003-4CF6-BE92-C7A9722FE749"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}