Webdetails cpf up to 9.5.0.0-1 DependenciesPackage.java baseUrl cross site scripting
Summary
A vulnerability classified as problematic was found in Webdetails cpf up to 9.5.0.0-1. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl results in cross site scripting. This vulnerability was named CVE-2021-4266. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.
Details
A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-1. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.
The weakness was presented 12/21/2022 as 365. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2021-4266. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.
Upgrading to version 9.5.0.0-2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3bff900d228e8cae3af256b447c5d15bdb03c174 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.
Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
Version
License
Website
- Product: https://github.com/webdetails/cpf/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.4VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.5
VulDB Temp Score: 3.4
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.1
NVD Vector: 🔍
CNA Base Score: 3.5
CNA Vector (VulDB): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-79 / CWE-94 / CWE-74
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: cpf 9.5.0.0-2
Patch: 3bff900d228e8cae3af256b447c5d15bdb03c174
Timeline
12/21/2022 🔍12/21/2022 🔍
12/21/2022 🔍
01/21/2023 🔍
Sources
Product: github.comAdvisory: 365
Status: Confirmed
CVE: CVE-2021-4266 (🔍)
GCVE (CVE): GCVE-0-2021-4266
GCVE (VulDB): GCVE-100-216468
Entry
Created: 12/21/2022 19:11Updated: 01/21/2023 18:15
Changes: 12/21/2022 19:11 (44), 12/24/2022 15:00 (3), 01/21/2023 18:08 (2), 01/21/2023 18:15 (21)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.