CVE-2021-20115: XSS
A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20115 vulnerability?
CVE-2021-20115 is a reflected cross-site scripting vulnerability in TCExam <= 14.8.3.
How does CVE-2021-20115 vulnerability work?
The vulnerability occurs when the f, d, and dir parameters in tce_filemanager.php are not properly validated, allowing an attacker to craft a malicious link that can execute arbitrary script code on the target user's browser.
What is the severity of CVE-2021-20115?
CVE-2021-20115 has a severity value of 6.1, which is considered medium.
How can I fix CVE-2021-20115 vulnerability?
To fix CVE-2021-20115, update TCExam to version 14.8.4 or higher.
Where can I find more information about CVE-2021-20115 vulnerability?
You can find more information about CVE-2021-20115 vulnerability at https://www.tenable.com/security/research/tra-2021-32.