CVE-2021-35489 - Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter

Back Back to CVE browser

MEDIUM

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter

Published Nov 9, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 0.86%

Description

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22131
Advisory
https://www.gruppotim.it/redteam
x_refsource_MISCExploitThird Party Advisory
https://www.thruk.org/changelog.html
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-22131		Advisory
https://www.gruppotim.it/redteam		x_refsource_MISCExploitThird Party Advisory
https://www.thruk.org/changelog.html		x_refsource_MISCRelease NotesVendor Advisory