PT-2021-17104
CVE-2021-26710
·
تاريخ النشر
2021-02-05
·
تاريخ التحديث
2022-02-04
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Redwood Report2Web versions 4.3.4.5 and 4.5.3
Description
A cross-site scripting (XSS) issue in the login panel allows remote attackers to inject JavaScript via the "signIn.do" API endpoint, specifically through the
urll parameter. This enables attackers to execute malicious scripts on the client-side.Recommendations
For Redwood Report2Web version 4.3.4.5, consider disabling the
signIn.do API endpoint until a patch is available.
For Redwood Report2Web version 4.5.3, restrict access to the urll parameter in the signIn.do API endpoint to minimize the risk of exploitation.
As a temporary workaround, avoid using the urll parameter in the signIn.do API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾