CVE-2021-47931: Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47931?
CVE-2021-47931 is classified as a medium severity vulnerability due to the potential for authenticated attackers to exploit the stored XSS vulnerability.
How do I fix CVE-2021-47931?
To fix CVE-2021-47931, update Exponent CMS to the latest version that addresses this vulnerability as it is present in version 2.6.
Who is affected by CVE-2021-47931?
Users of Exponent CMS version 2.6 are affected by CVE-2021-47931, specifically those allowing user-generated content.
What is the impact of CVE-2021-47931?
The impact of CVE-2021-47931 allows authenticated attackers to inject malicious scripts that can execute in users' browsers.
Is CVE-2021-47931 related to other vulnerabilities?
CVE-2021-47931 may be related to other stored XSS vulnerabilities, emphasizing the importance of secure coding practices.