CVE-2021-3030: Cute Editor for ASP.NET Cute Editor for ASP.NET vulnerability
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpickermore.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component, executes arbitrary JavaScript in the security context of that site.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running Cute Editor for ASP.NET 6.4 are exposed when an authenticated user can be induced to open an attacker-crafted URL in their browser. The attacker does not need to authenticate to create or deliver the malicious URL.
What does an attacker need to exploit the vulnerability?
The attacker needs to craft a URL that supplies a malicious Theme GET parameter to colorpicker_more.aspx and convince a victim with an authenticated browser session on the affected site to open it. Successful exploitation runs arbitrary JavaScript in that site's security context.