CVE-2021-21434 — Cross-site Scripting in AG Survey

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
CNA3.5
EPSS
0.4%
top 41.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Otrs AG SurveyOtrs Survey
Timeline
PublishedFeb 8
Latest updateMay 24

Description

Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i.e. another agent who wants to make changes in the survey). This issue affects: OTRS AG Survey 6.0.x version 6.0.20 and prior versions; 7.0.x version 7.0.19 and prior versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDotrs/survey6.0.0 — 6.0.20+1
▶CVEListV5otrs_ag/survey6.0.x — 6.0.20+1

🔴Vulnerability Details

3
GHSA
GHSA-2rff-cr3q-94jm: Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i↗2022-05-24
▶
CVEList
XSS in Survey Module↗2021-02-08
▶
OSV
CVE-2021-21434: Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface (i↗2021-02-08
▶
CVE-2021-21434 — Cross-site Scripting in Otrs AG Survey | cvebase