CVE Vulnerability

CVE-2020-21316

A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6 Patch Third Party Advisory
https://github.com/94fzb/zrlog/issues/56 Patch Third Party Advisory
https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:zrlog:zrlog:2.1.3:*:*:*:*:*:*:*
Information

Published : 2021-06-15 08:15

Updated : 2021-06-22 01:05

NVD link : CVE-2020-21316

Mitre link : CVE-2020-21316

Products Affected
No products.
CWE
CWE-79