What is CVE-2021-38707?

CVE-2021-38707 is a medium-severity vulnerability in Cliniccases, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-09-07.

How severe is CVE-2021-38707?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2021-38707 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Cliniccases

CVE-2021-38707

Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (47.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Cliniccases — versions 7.3.3
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC, Release Notes)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-38707?: CVE-2021-38707 is a medium-severity vulnerability in Cliniccases, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-09-07.
How severe is CVE-2021-38707?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2021-38707 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.