CVE-2021-42118 Stored XSS in TopEase
Authenticated attackers can inject malicious scripts into object attributes, leading to cookie theft and account takeover via stored XSS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42118?
CVE-2021-42118 is a high-severity cross-site scripting vulnerability in Business-DNA Solutions GmbH TopEase, published on 30 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
Weakness: CWE-79
Which versions are affected by CVE-2021-42118?
It affects 1 product.
Products include Businessdnasolutions Topease.
How do I fix CVE-2021-42118?
No fix has been published for CVE-2021-42118 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-42118 being exploited?
There is no known exploitation of CVE-2021-42118 in the wild and no public exploit code.
Other vulnerabilities in Business-DNA Solutions GmbH TopEase
- CVE-2021-42115 Missing HTTPOnly flag on sensitive cookie in TopEase
- CVE-2021-42544 Lack of Rate limiting in Authentication in TopEase
- CVE-2021-42119 Stored XSS in Search Function in TopEase
- CVE-2021-42123 Missing Upload Filter in TopEase
- CVE-2021-42120 Missing Character Length (Denial of Service) in TopEase
Sources
Also known as GHSA-qjch-qr2h-mw52.