{"id":"CVE-2021-4035","state":"PUBLISHED","title":"Wocu Monitoring stored Cross-Site Scripting (XSS)","description":"A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.","publishedAt":"2022-02-11T17:40:04.786Z","updatedAt":"2024-09-16T16:38:39.868Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["A3Sec Wocu Monitoring"],"affected":[{"vendor":"A3Sec","product":"Wocu Monitoring","defaultStatus":"unaffected","versions":[{"version":"0.27","status":"affected","lessThan":"48.2","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:49:23.890Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/4xxx/CVE-2021-4035.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-4035","state":"PUBLISHED","datePublished":"2022-02-11T17:40:04.786Z","dateUpdated":"2024-09-16T16:38:39.868Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2021-11-30T00:00:00.000Z"},"containers":{"cna":{"title":"Wocu Monitoring stored Cross-Site Scripting (XSS)","descriptions":[{"lang":"en","value":"A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports."}],"affected":[{"vendor":"A3Sec","product":"Wocu Monitoring","defaultStatus":"unaffected","versions":[{"version":"0.27","status":"affected","lessThan":"48.2","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2023-11-22T10:24:03.682Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"David Cámara Galindo"}],"datePublic":"2022-02-06T23:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"This vulnerability has been solved by A3Sec in the 48.2 version."}],"value":"This vulnerability has been solved by A3Sec in the 48.2 version."}],"source":{"advisory":"INCIBE-2022-0593","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve-coordination@incibe.es","DATE_PUBLIC":"2022-02-07T08:00:00.000Z","ID":"CVE-2021-4035","STATE":"PUBLIC","TITLE":"Wocu Monitoring stored Cross-Site Scripting (XSS)"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Wocu Monitoring","version":{"version_data":[{"version_affected":">=","version_name":"0.27","version_value":"0.27"},{"version_affected":"<","version_name":"48.2","version_value":"48.2"}]}}]},"vendor_name":"A3Sec"}]}},"credit":[{"lang":"eng","value":"David Cámara Galindo"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}]},"references":{"reference_data":[{"name":"https://www.incibe-cert.es/en/early-warning/security-advisories/wocu-monitoring-stored-cross-site-scripting-xss","refsource":"CONFIRM","url":"https://www.incibe-cert.es/en/early-warning/security-advisories/wocu-monitoring-stored-cross-site-scripting-xss"}]},"solution":[{"lang":"en","value":"This vulnerability has been solved by A3Sec in the 48.2 version."}],"source":{"advisory":"INCIBE-2022-0593","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/wocu-monitoring-stored-cross-site-scripting-xss","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T17:16:03.303Z"}}]}}}