Cross-Site Scripting Vulnerability in Spotweb by Spotweb
CVE-2021-40971

6.1MEDIUM

Key Information:

Vendor

Spotweb Project

Status
Spotweb
Vendor
CVE Published:
1 October 2021

What is CVE-2021-40971?

The identified cross-site scripting (XSS) vulnerability in Spotweb versions 1.5.1 and below can be exploited by remote attackers. Specifically, the vulnerability resides in the templates/installer/step-004.inc.php file, allowing unauthorized users to inject arbitrary web scripts or HTML code via the newpassword1 parameter. This could potentially compromise the integrity of user sessions, lead to data theft, or redirect users to malicious sites.

References

https://github.com/spotweb/spotweb
x_refsource_MISC
https://github.com/spotweb/spotweb/issues/711
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.