CVE-2021-36805
Assigner: rapid7
Published: 2021-07-27T00:00:00
State: PUBLISHED
affected: product: Akaunting
vendor: Akaunting
versions: lessThanOrEqual: 2.1.12
status: affected
version: 2.1.12
versionType: custom
credits: value: Wiktor Sędkowski of Nokia and Trevor Christiansen of Rapid7 discovered and reported this issue through Rapid7's vulnerability disclosure program.
datePublic: 2021-07-27T00:00:00
descriptions: value: Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the sales invoice processing component of the application. This issue was fixed in version 2.1.13 of the product.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
source: discovery: EXTERNAL
title: Akaunting Invoice Footer Persistent XSS
x_generator: engine: Vulnogram 0.0.9