Stored Cross Site Scripting Vulnerability in Landray EKP Software
CVE-2021-3159

5.4MEDIUM

Key Information:

Vendor

Landray

Status
Landray Ekp
Vendor
CVE Published:
23 July 2021

What is CVE-2021-3159?

A stored cross site scripting (XSS) vulnerability exists in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325. This security flaw allows attackers to execute arbitrary web scripts or HTML, potentially leading to unauthorized actions on behalf of users who interact with the affected application. Attackers can exploit this vulnerability by uploading crafted SVG, SHTML, or MHT files, exposing users and systems to significant risks.

References

https://github.com/fa1c0n1/m01e-wiki/blob/main/my-vulns/l...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.