PT-2021-17104 · Redwood · Redwood Report2Web

Published 2021-02-05 · Updated 2022-02-04 · CVE-2021-26710

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redwood Report2Web versions 4.3.4.5 and 4.5.3

Description A cross-site scripting (XSS) issue in the login panel allows remote attackers to inject JavaScript via the "signIn.do" API endpoint, specifically through the urll parameter. This enables attackers to execute malicious scripts on the client-side.

Recommendations For Redwood Report2Web version 4.3.4.5, consider disabling the signIn.do API endpoint until a patch is available. For Redwood Report2Web version 4.5.3, restrict access to the urll parameter in the signIn.do API endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the urll parameter in the signIn.do API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-26710

Affected Products

Redwood Report2Web

References · 6

• 🔥 https://vict0ni.me/redwood-report2web-xss-and-frame-injection · Exploit
• 🔥 https://vict0ni.me/report2web-xss-frame-injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-26710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26710 · Security Note
• https://t.me/cvenotify/26062 · Telegram Post
• https://t.me/cibsecurity/23157 · Telegram Post