Stored XSS Vulnerability in Ericsson ECM's User Profile Management
CVE-2021-41391

5.4MEDIUM

Key Information:

Vendor

Ericsson

Status
Enterprise Content Management
Vendor
CVE Published:
17 September 2021

What is CVE-2021-41391?

The Security Management Endpoint in the User Profile Management section of Ericsson's ECM before version 18.0 is exposed to a stored XSS vulnerability. This flaw allows an attacker to inject malicious scripts via user names, potentially leading to unauthorized access, session hijacking, and full account takeover. Organizations using affected versions should prioritize immediate remediation to secure user data and maintain the integrity of their systems.

References

https://the-it-wonders.blogspot.com/2021/09/ericsson-ecm-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-41391 : Stored XSS Vulnerability in Ericsson ECM's User Profile Management