CVE Vulnerability

CVE-2021-42078

PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-049.txt Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2021/Nov/24 Exploit Mailing List
Configurations

Configuration 1

cpe:2.3:a:php_event_calendar_project:php_event_calendar:2021-11-04:*:*:*:lite:*:*:*
Information

Published : 2021-11-08 05:15

Updated : 2021-11-09 10:07

NVD link : CVE-2021-42078

Mitre link : CVE-2021-42078

Products Affected
No products.
CWE
CWE-79