What is CVE-2021-31930?

CVE-2021-31930 is a medium-severity vulnerability in Concerto-Signage Concerto, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-05-19.

How severe is CVE-2021-31930?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Concerto-Signage Concerto

CVE-2021-31930

Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Concerto-signage Concerto
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-31930?: CVE-2021-31930 is a medium-severity vulnerability in Concerto-Signage Concerto, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-05-19.
How severe is CVE-2021-31930?: Medium severity. CVSS v3 base score is 6.1 out of 10.