CVE-2021-36572

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/liufee/cms/issues/58	Exploit Issue Tracking Third Party Advisory
https://github.com/liufee/cms/issues/58	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:feehi:feehicms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:13

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de Cross Site Scripting (XSS) en Feehi CMS hasta 2.1.1 permite a los atacantes ejecutar código arbitrario a través del campo user name de la página de inicio de sesión.
References	~~() https://github.com/liufee/cms/issues/58 - Exploit, Issue Tracking, Third Party Advisory~~	() https://github.com/liufee/cms/issues/58 - Exploit, Issue Tracking, Third Party Advisory

Information

Published : 2022-12-15 19:15

Updated : 2025-04-21 19:15

NVD link : CVE-2021-36572

Mitre link : CVE-2021-36572

CVE.ORG link : CVE-2021-36572

JSON object : View

Products Affected

feehi

feehicms

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-36572", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-12-15T19:15:15.860", "references": [{"url": "https://github.com/liufee/cms/issues/58", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/liufee/cms/issues/58", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page."}, {"lang": "es", "value": "La vulnerabilidad de Cross Site Scripting (XSS) en Feehi CMS hasta 2.1.1 permite a los atacantes ejecutar c\u00f3digo arbitrario a trav\u00e9s del campo user name de la p\u00e1gina de inicio de sesi\u00f3n."}], "lastModified": "2025-04-21T19:15:16.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:feehi:feehicms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC1BB163-E338-4110-A6B8-0AF9510EDE25", "versionEndIncluding": "2.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

6.1 /10