PT-2021-10586
CVE-2020-21088
·
تاريخ النشر
2021-04-14
·
تاريخ التحديث
2021-04-21
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
X2engine X2CRM versions prior to 7.1
Description:
The issue allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the
First Name and Last Name fields in the "/index.php/contacts/create" page. This is a Cross Site Scripting (XSS) issue.Recommendations:
For versions prior to 7.1, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting input for the
First Name and Last Name fields to minimize the risk of arbitrary script injection.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾