CVE-2021-25982: FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality
In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-25982?
CVE-2021-25982 is a vulnerability in Factor (App Framework & Headless CMS) forum plugin versions 1.3.5 to 1.8.30 that allows for reflected Cross-Site Scripting (XSS) attacks.
What is the severity of CVE-2021-25982?
The severity of CVE-2021-25982 is medium, with a severity value of 6.1.
How can an attacker exploit CVE-2021-25982?
An unauthenticated attacker can exploit CVE-2021-25982 by injecting malicious JavaScript code through the 'search' parameter in the URL, potentially stealing session cookies.
Which versions of Factor (App Framework & Headless CMS) forum plugin are affected by CVE-2021-25982?
Versions 1.3.5 to 1.8.30 of the Factor forum plugin are affected by CVE-2021-25982.
How can I mitigate CVE-2021-25982?
To mitigate CVE-2021-25982, it is recommended to upgrade to a version of the Factor forum plugin that is not affected by the vulnerability.