What is CVE-2021-4035?

CVE-2021-4035 is a low-severity vulnerability in A3sec Wocu Monitoring, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2022-02-11.

How severe is CVE-2021-4035?

Low severity. CVSS v3 base score is 3.5 out of 10.

Is CVE-2021-4035 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in A3sec Wocu Monitoring

CVE-2021-4035

A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (36.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N.

Affected products

A3sec Wocu Monitoring — versions 0.27
Wocu-monitoring Wocu_monitoring

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

cve-coordination@incibe.es (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2021-4035?: CVE-2021-4035 is a low-severity vulnerability in A3sec Wocu Monitoring, classified under Cross-site Scripting. CVSS score: 3.5/10. Published 2022-02-11.
How severe is CVE-2021-4035?: Low severity. CVSS v3 base score is 3.5 out of 10.
Is CVE-2021-4035 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.