CVE-2021-37470: XSS
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-37470?
CVE-2021-37470 is a vulnerability in NCH WebDictate v2.13 that allows for persistent Cross Site Scripting (XSS) attacks.
What is the severity of CVE-2021-37470?
The severity of CVE-2021-37470 is medium with a CVSS score of 5.4.
How does CVE-2021-37470 affect NCH WebDictate?
CVE-2021-37470 affects NCH WebDictate v2.13 by allowing authenticated users to inject arbitrary JavaScript through the Recipient Name field.
Is there a fix for CVE-2021-37470?
At the moment, there is no official fix available for CVE-2021-37470. It is recommended to implement necessary mitigations and avoid using the affected software until a fix is released.
Where can I find more information about CVE-2021-37470?
More information about CVE-2021-37470 can be found in the references provided: [GitHub POC](https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md), [NCH WebDictate](https://www.nch.com.au/webdictate/index.html).