Cross Site Scripting Vulnerability in Workerman-ThinkPHP-Redis by HappyLiu2014
CVE-2021-43697

6.1MEDIUM

Key Information:

Vendor

Workerman-thinkPHP-redis Project

Status
Workerman-thinkPHP-redis
Vendor
CVE Published:
29 November 2021

What is CVE-2021-43697?

The Workerman-ThinkPHP-Redis package is susceptible to Cross Site Scripting (XSS) due to improper handling of user input in the Controller.class.php file. When the script encounters an exit function that outputs the message containing the user-controllable variable $_GET{C('VAR_JSONP_HANDLER')}, an attacker can inject malicious scripts. This flaw can lead to unauthorized execution of scripts in the context of other users, compromising the security of web applications relying on this package.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.