CVE-2021-42856
Assigner: GovTech CSG
Published: 2022-02-23T00:00:00
State: PUBLISHED
affected: product: SteelCentral AppInternals Dynamic Sampling Agent
vendor: Aternity
versions: status: affected
version: 10.x
lessThan: 12.13.0
status: affected
version: 12.13.0
versionType: custom
lessThan: 11.8.8
status: affected
version: 11.8.8
versionType: custom
credits: value: Darrel Huang, Bjorn Lim, Leng Kang Hao from Government Technology Agency of Singapore
datePublic: 2022-02-23T00:00:00
descriptions: value: It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: INTERNAL
title: Reflected Cross-site Scripting at DsaDataTest
x_generator: engine: Vulnogram 0.0.9