VulnerabilityModified

CVE-2021-47808

Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter.

MEDIUM 5.1EPSS 0.27%

Does this matter?

Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.

Description

Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicious JavaScript code through the 'maintitle' parameter to execute scripts when administrators view the page.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.27% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: cotonti/cotonti siena
Source: disclosure@vulncheck.com

References

https://cotonti.comBroken Link
https://www.cotonti.com/download/Product
https://www.exploit-db.com/exploits/50016Exploit
https://www.vulncheck.com/advisories/cotonti-siena-maintitle-stored-cross-site-scriptingThird Party Advisory
https://www.exploit-db.com/exploits/50016Exploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.