Vulnerability CVE-2021-20785

Vulnerability CVE-2021-20785

Published: 2021-07-30

Description:

Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0) allows a remote attacker to inject an arbitrary script by sending a specially crafted request to a specific URL.

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
3.5/10	2.9/10	6.8/10

Exploit range	Attack complexity	Authentication
Remote	Medium	Single time
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Groupsession -> Groupsession
Groupsession -> Groupsession bycloud
Groupsession -> Groupsession zion

References:

https://groupsession.jp/info/info-news/security202107

https://jvn.jp/en/jp/JVN86026700/index.html

Copyright 2024, cxsecurity.com