PT-2021-4033 · Tcexam · Tcexam

Derrie Sutton · Published 2021-07-21 · Updated 2021-08-12 · CVE-2021-20115

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TCExam versions prior to 14.8.4

Description A reflected cross-site scripting issue exists due to improper validation of the paths provided in the f, d, and dir parameters in tce filemanager.php. This could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victim's session or performing actions on their behalf.

Recommendations For versions prior to 14.8.4, update to version 14.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the tce filemanager.php file to minimize the risk of exploitation. Avoid using the parameters f, d, and dir in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04560

CVE-2021-20115

Affected Products

Tcexam

References · 4

• 🔥 https://tenable.com/security/research/tra-2021-32 · Exploit
• https://osv.dev/vulnerability/CVE-2021-20115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20115 · Security Note
• https://bdu.fstec.ru/vul/2021-04560 · Security Note