CVE-2021-46387

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

21.03% chance of exploitation in the next 30 days, 97th percentile

Nuclei

medium · CWE-79

Published

2022-03-01

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.html
• https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharing

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-46387.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50797

References

• CVE Record
• NVD entry

Related

• CVE-2021-46382
• CVE-2021-46393
• CVE-2021-46381
• CVE-2021-46394
• CVE-2021-46379
• CVE-2021-46398