CVE-2021-4035

Wocu Monitoring stored Cross-Site Scripting (XSS)

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.

Affected

A3Sec · Wocu Monitoring

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 INCIBE

3.5 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.45% chance of exploitation in the next 30 days, 37th percentile

Published

2022-02-11

Updated

2024-09-16

Proof-of-concept exploits (1)

• 0xalwayslucky/log4j-polkit-poc1★ · 2022-01-28

References

• CVE Record
• NVD entry

Related

• CVE-2021-4034
• CVE-2021-44228