PT-2021-21718 · Unknown · Ttiny Java Web Server/Servlet Container

Maurizio Ruchay · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-37573

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TTiny Java Web Server and Servlet Container (TJWS) versions <=1.115

Description A reflected cross-site scripting (XSS) issue allows an adversary to inject malicious code on the server's "404 Page not Found" error page. This occurs in the web server TTiny Java Web Server and Servlet Container (TJWS).

Recommendations For versions <=1.115, update to a version greater than 1.115 to resolve the issue. As a temporary workaround, consider restricting access to the "404 Page not Found" error page until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37573

Affected Products

Ttiny Java Web Server/Servlet Container

References · 7

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-042.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/163825/Tiny-Java-Web-Server-1.115-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/Aug/13 · Exploit
• https://osv.dev/vulnerability/CVE-2021-37573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37573 · Security Note
• https://t.me/cibsecurity/27014 · Telegram Post
• https://t.me/defcon_news/82920 · Telegram Post