CVE-2021-20672: XSS
Published Mar 10, 2021
·Updated
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.
Affected Software
1 affected component
WESEEK GROWI>=4.2.0<=4.2.7
Event History
Mar 10, 2021
CVE Published
via MITRE·09:20 AM
Data Sourced
via MITRE·09:20 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-20672?
CVE-2021-20672 is categorized as a reflected cross-site scripting vulnerability which can have a high impact on application security.
2
How do I fix CVE-2021-20672?
To fix CVE-2021-20672, upgrade GROWI to version 4.2.8 or later where the vulnerability has been patched.
3
What are the affected versions for CVE-2021-20672?
CVE-2021-20672 affects GROWI versions from 4.2.0 to 4.2.7 inclusive.
4
What kind of attack is possible with CVE-2021-20672?
CVE-2021-20672 allows remote attackers to inject arbitrary scripts, potentially compromising user sessions or data.
5
Is CVE-2021-20672 exploitable without authentication?
Yes, CVE-2021-20672 can be exploited by unauthenticated users through crafted URLs.