CVE Vulnerability

CVE-2021-43810

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Admidio/admidio/commit/fcb0609abc1d2f65bc1377866bd678e5d891404b Patch Third Party Advisory
https://github.com/Admidio/admidio/commit/c043267d362f7813543cc2785119bf3e3e54fe21 Patch Third Party Advisory
https://github.com/Admidio/admidio/security/advisories/GHSA-3qgf-qgc3-42hh Third Party Advisory
https://github.com/Admidio/admidio/releases/tag/v4.0.12 Patch Release Notes
Configurations

Configuration 1

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:*
Information

Published : 2021-12-07 10:15

Updated : 2021-12-09 07:44

NVD link : CVE-2021-43810

Mitre link : CVE-2021-43810

Products Affected
No products.
CWE
CWE-79