VulnerabilityAnalyzed
CVE-2021-47768
ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads.
MEDIUM 5.3EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- cleidigh/importexporttools ng
- Source
- disclosure@vulncheck.com
References
- https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/Product
- https://github.com/thundernest/import-export-tools-ngProduct
- https://www.exploit-db.com/exploits/50496Exploit
- https://www.vulnerability-lab.com/get_content.php?id=2308Third Party Advisory
- https://www.exploit-db.com/exploits/50496Exploit
- https://www.vulnerability-lab.com/get_content.php?id=2308Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.