← voltar
CVE-2021-3111

CVE-2021-3111

EPSS 3.0%
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI.
Produtos afetados
n/a · n/a
PoCs públicas encontradas — 3
cve_referencepacketstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.htmlnão verificadocve_referencepacketstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/49721não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →
Referências
http://packetstormsecurity.com/files/161600/Concrete5-8.5.4-Cross-Site-Scripting.htmlhttp://packetstormsecurity.com/files/161997/Concrete5-8.5.4-Cross-Site-Scripting.htmlhttps://documentation.concrete5.org/developers/introduction/version-historyhttps://documentation.concrete5.org/developers/introduction/version-history/855-release-noteshttps://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf