CVE-2021-35303: XSS
Published Jun 28, 2021
·Updated
Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute.
Affected Software
1 affected component
Zammad Zammad>=1.0.0<=4.0.0
Event History
Jun 28, 2021
CVE Published
via MITRE·07:06 PM
Data Sourced
via MITRE·07:06 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for the Cross Site Scripting (XSS) vulnerability in Zammad?
The vulnerability ID for the Cross Site Scripting (XSS) vulnerability in Zammad is CVE-2021-35303.
2
What is the severity of CVE-2021-35303?
The severity of CVE-2021-35303 is medium with a CVSS score of 6.1.
3
What is affected by the Cross Site Scripting (XSS) vulnerability in Zammad?
Zammad versions 1.0.x up to 4.0.0 are affected by the Cross Site Scripting (XSS) vulnerability.
4
How can remote attackers exploit CVE-2021-35303?
Remote attackers can exploit CVE-2021-35303 by executing arbitrary web script or HTML via the User Avatar attribute in Zammad.
5
Is there a fix available for CVE-2021-35303?
Yes, a fix is available for CVE-2021-35303. It is recommended to update Zammad to version 4.0.1 or later to mitigate the vulnerability.