CVE-2021-3333: XSS

Published Feb 5, 2021

Updated

Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.

Affected Software

1 affected component

Opmantek Open-AudIT=4.0.1

Remediation

Patch Available

https://community.opmantek.com/display/OA/Errata+-+4.0.1+XSS+in+SQL+debugging+output

Event History

Feb 5, 2021

CVE Published

via MITRE·01:01 PM

Data Sourced

via MITRE·01:01 PM

Description

Data Sourced

via NVD·02:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2021-3333?

CVE-2021-3333 is a vulnerability in Opmantek Open-AudIT 4.0.1 that allows for cross-site scripting (XSS) attacks.

How does CVE-2021-3333 work?

CVE-2021-3333 allows for XSS attacks by using a maliciously crafted query when outputting SQL statements for debugging.

What is the severity of CVE-2021-3333?

CVE-2021-3333 has a severity rating of 6.1 (medium).

Is CVE-2021-3333 only exploitable if the user is logged in?

Yes, CVE-2021-3333 can only be exploited if the user is already logged in to Open-AudIT before clicking the malicious link.

How can I fix CVE-2021-3333?

To fix CVE-2021-3333, it is recommended to update to a version of Open-AudIT that is not affected by this vulnerability.