CVE-2021-40191: XSS

Published Oct 11, 2021

Updated

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type of output data in webroot/dzz/attach/controller.php.

Affected Software

1 affected component

dzzoffice DzzOffice=2.02.1

Event History

Oct 11, 2021

CVE Published

via MITRE·01:34 PM

Data Sourced

via MITRE·01:34 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for Dzzoffice Version 2.02.1?

The vulnerability ID for Dzzoffice Version 2.02.1 is CVE-2021-40191.

What is the severity level of CVE-2021-40191?

The severity level of CVE-2021-40191 is medium with a severity value of 5.4.

How does CVE-2021-40191 affect Dzzoffice Version 2.02.1?

CVE-2021-40191 affects Dzzoffice Version 2.02.1 by allowing cross-site scripting (XSS) attacks due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and returning a wrong response in the content-type of output data in webroot/dzz/attach/controller.php.

Which software versions are affected by CVE-2021-40191?

CVE-2021-40191 affects Dzzoffice Version 2.02.1.

How can I fix the cross-site scripting (XSS) vulnerability in Dzzoffice Version 2.02.1?

To fix the cross-site scripting (XSS) vulnerability in Dzzoffice Version 2.02.1, it is recommended to sanitize input data at all upload functions in webroot/dzz/attach/Uploader.class.php and ensure the correct response in the content-type of output data in webroot/dzz/attach/controller.php.