PT-2021-22845 · Webuzo · Webuzo

Omri Inbar · Published 2021-09-15 · Updated 2021-09-28 · CVE-2021-40238

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webuzo versions prior to 2.9.0

Description A Cross Site Scripting (XSS) issue exists in the admin panel of Webuzo via an HTTP request to a non-existent page. This is triggered when administrators view the "Error Log" page. An attacker can exploit this to achieve Unauthenticated Remote Code Execution through the "Cron Jobs" functionality.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Error Log" page and the "Cron Jobs" functionality to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-40238

Affected Products

Webuzo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-40238 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40238 · Vendor Advisory
• https://webuzo.com/blog/webuzo-2-9-0-launched · Vendor Advisory
• https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e · Note
• https://t.me/cibsecurity/28929 · Telegram Post