PT-2021-23572 · Unknown · Shinher Studyonline System

Allen.Liu + 1 · Published 2021-10-15 · Updated 2021-10-20 · CVE-2021-42329

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ShinHer StudyOnline System (affected versions not specified)

Description The issue concerns the List Add function of the message board in ShinHer StudyOnline System, which fails to filter special characters in the title parameter. This allows remote attackers to inject JavaScript and execute stored XSS attacks after logging in with a user's privilege.

Recommendations For ShinHer StudyOnline System, consider disabling the List Add function until a patch is available to prevent the injection of JavaScript and execution of stored XSS attacks. Restrict access to the message board to minimize the risk of exploitation. Avoid using the title parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42329

Affected Products

Shinher Studyonline System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-42329 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42329 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-5199-61238-1.html · Note
• https://t.me/cibsecurity/30624 · Telegram Post