PT-2021-10608 · Zrlog · Zrlog

T-Podo · Published 2021-06-15 · Updated 2021-06-22 · CVE-2020-21316

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ZrLog version 2.1.3

Description: A Cross-site scripting (XSS) vulnerability exists in the comment section, which allows remote attackers to inject arbitrary web script and steal administrator cookies via the nickname parameter, gaining access to the admin panel.

Recommendations: For ZrLog version 2.1.3, consider disabling the comment section or restricting access to it until a patch is available to prevent exploitation of the XSS vulnerability. Avoid using the nickname parameter in the comment section until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21316

Affected Products

Zrlog

References · 7

• https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941 · Patch
• https://github.com/94fzb/zrlog/issues/56 · Patch
• https://osv.dev/vulnerability/CVE-2020-21316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21316 · Security Note
• https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6 · Patch
• https://t.me/cvenotify/16384 · Telegram Post
• https://t.me/cibsecurity/25473 · Telegram Post