CVE-2021-36695

Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.57% chance of exploitation in the next 30 days, 45th percentile

Published

2021-09-08

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.r29k.com/articles/bb/stored-xss-in-deskpro#anchor1

References

• CVE Record
• NVD entry

Related

• CVE-2021-36691
• CVE-2021-36696
• CVE-2021-36690
• CVE-2021-36705
• CVE-2021-36689
• CVE-2021-36706