PT-2022-11612 · Alcoda · Alcoda Netbiblio Webopac

Patrick Schmid + 1 · Published 2022-01-14 · Updated 2022-01-21 · CVE-2021-42551

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320 AlCoda NetBiblio WebOPAC versions later than 4.0.0.328

Description A Cross-site Scripting (XSS) issue exists in the search functionality of AlCoda NetBiblio WebOPAC, allowing an unauthenticated user to craft a reflected Cross-Site Scripting attack.

Recommendations For AlCoda NetBiblio WebOPAC versions prior to 4.0.0.320, update to version 4.0.0.335 or later. For AlCoda NetBiblio WebOPAC versions later than 4.0.0.328, update to version 4.0.0.335 or later. As a temporary workaround, consider restricting access to the search functionality until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42551

Affected Products

Alcoda Netbiblio Webopac

References · 4

• 🔥 https://redguard.ch/advisories/netbiblio_webopac.txt · Exploit
• https://osv.dev/vulnerability/CVE-2021-42551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42551 · Security Note
• https://t.me/cibsecurity/35488 · Telegram Post