CVE-2021-42335

{"id": "CVE-2021-42335", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-10-15T12:15:07.947", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-5206-3cd3f-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user\u2019s privilege, remote attackers can inject JavaScript and execute stored XSS attack."}, {"lang": "es", "value": "La funci\u00f3n de administraci\u00f3n del tabl\u00f3n de anuncios de la plataforma de aprendizaje en l\u00ednea Easytest no filtra los caracteres especiales. Despu\u00e9s de alcanzar privilegios de usuario, unos atacantes remotos pueden inyectar JavaScript y ejecutar un ataque de tipo XSS almacenado"}], "lastModified": "2024-11-21T06:27:37.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huaju:easytest_online_learning_test_platform:1705:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63605331-63BE-4B6B-9E62-43179A48FAAB"}], "operator": "OR"}]}], "sourceIdentifier": "twcert@cert.org.tw"}