What is CVE-2021-40238?

CVE-2021-40238 is a medium-severity vulnerability in Webuzo, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-09-15.

How severe is CVE-2021-40238?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Webuzo

CVE-2021-40238

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.010 (61.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Webuzo
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2021-40238?: CVE-2021-40238 is a medium-severity vulnerability in Webuzo, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2021-09-15.
How severe is CVE-2021-40238?: Medium severity. CVSS v3 base score is 6.1 out of 10.