XSS Vulnerability in Scoold Knowledge Base Platform
CVE-2021-46372

5.4MEDIUM

Key Information:

Vendor
Erudika
Status
Scoold
Vendor
CVE Published:
18 February 2022

Summary

Scoold 1.47.2, a Java-based Q&A and knowledge base platform, features a markdown editor that is vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability is triggered when users input uppercase letters while creating Q&A content, allowing malicious scripts to be executed in the context of the victim's browser. Attackers can exploit this weakness to manipulate user interactions and steal sensitive information, thus highlighting the need for immediate security measures to mitigate the risk.

References

https://www.huntr.dev/bounties/eb681144-04f2-4eaa-98b6-c8...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.