Reflected Cross-Site Scripting Vulnerability in TCExam by TCExam
CVE-2021-20115

6.1MEDIUM

Key Information:

Vendor

Tecnick

Status
Tcexam
Vendor
CVE Published:
5 August 2021

What is CVE-2021-20115?

A reflected cross-site scripting vulnerability in TCExam prior to version 14.8.3 allows an attacker to exploit insufficient input validation within the tce_filemanager.php file. Attackers can manipulate the f, d, and dir parameters to craft a malicious link. If an administrator is tricked into clicking this link, it can lead to session hijacking or unauthorized actions performed on their behalf, primarily impacting the security and integrity of user data.

Affected Version(s)

TCExam <= 14.8.3

References

https://www.tenable.com/security/research/tra-2021-32
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.