PT-2021-20345 · Zoho · Zoho Crm Lead Magnet

Published 2021-10-05 · Updated 2021-10-14 · CVE-2021-33849

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zoho CRM Lead Magnet version 1.7.2.4

Description: A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets the application's users and not the application itself, using the application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form.

Recommendations: For Zoho CRM Lead Magnet version 1.7.2.4, consider disabling the functionality that allows users to change form values or delete created forms until a patch is available. Restrict access to the affected forms to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33849

Affected Products

Zoho Crm Lead Magnet

References · 6

• 🔥 https://cybersecurityworks.com/zerodays/cve-2021-33849-stored-cross-site-scripting-xss-in-wordpress-plugin-zoho-crm-lead-magnet-version-1-7-2-4.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-33849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33849 · Security Note
• https://t.me/cvenotify/21963 · Telegram Post
• https://t.me/cibsecurity/30018 · Telegram Post
• https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.html · Note