XSS in Lorensbergs Connect2
CVE-2021-43960
Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Lorensbergs Connect2 — versions 3.13.7647.20190
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-43960?
- CVE-2021-43960 is a medium-severity vulnerability in Lorensbergs Connect2, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2022-01-12.
- How severe is CVE-2021-43960?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2021-43960 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.