CVE-2021-20723

{"id": "CVE-2021-20723", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2021-05-24T04:15:14.947", "references": [{"url": "https://jvn.jp/en/jp/JVN53910556/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.php-factory.net/mail/01.php", "tags": ["Product", "Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN53910556/index.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.php-factory.net/mail/01.php", "tags": ["Product", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descriptions in the program file is from 2014 December 12 to 2018 July 27) allows a remote attacker to inject an arbitrary script via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting reflejada en la edici\u00f3n gratuita [MailForm01] (versiones cuya \u00faltima fecha de actualizaci\u00f3n que figura en la parte superior de las descripciones en el archivo del programa es del 12 de diciembre de 2014 al 27 de julio de 2018) permite a un atacante remoto inyectar un script arbitrario por medio de vectores no especificados"}], "lastModified": "2024-11-21T05:47:04.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mailform01_project:mailform01:*:*:*:*:free:*:*:*", "vulnerable": true, "matchCriteriaId": "1E1A3BB1-545C-40FE-A8E5-31547C62F6B8", "versionEndIncluding": "2018-07-27", "versionStartIncluding": "2014-12-12"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}