CVE-2021-42329

ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS

State: Published
Severity: 5.4 Medium
Published: Oct 15, 2021
Updated: Sep 17, 2024
Reserved: Oct 12, 2021

Description

The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	twcert

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
ShinHer StudyOnline SystemShinHer Information Co., LTD.	2021 and earlierAffected

References

https://www.twcert.org.tw/tw/cp-132-5199-61238-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.