CVE-2021-35303: XSS
First published: Mon Jun 28 2021(Updated: )
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zammad Zammad | >=1.0.0<=4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Cross Site Scripting (XSS) vulnerability in Zammad?
The vulnerability ID for the Cross Site Scripting (XSS) vulnerability in Zammad is CVE-2021-35303.
What is the severity of CVE-2021-35303?
The severity of CVE-2021-35303 is medium with a CVSS score of 6.1.
What is affected by the Cross Site Scripting (XSS) vulnerability in Zammad?
Zammad versions 1.0.x up to 4.0.0 are affected by the Cross Site Scripting (XSS) vulnerability.
How can remote attackers exploit CVE-2021-35303?
Remote attackers can exploit CVE-2021-35303 by executing arbitrary web script or HTML via the User Avatar attribute in Zammad.
Is there a fix available for CVE-2021-35303?
Yes, a fix is available for CVE-2021-35303. It is recommended to update Zammad to version 4.0.1 or later to mitigate the vulnerability.
- collector/nvd-index
- agent/event
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zammad
- canonical/zammad zammad
- version/zammad zammad/1.0.0
- version/zammad zammad/4.0.0