CVE-2021-38707

Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/judsonmitchell/ClinicCases/releases	Release Notes Third Party Advisory
https://github.com/sudonoodle/CVE-2021-38707	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cliniccases:cliniccases:7.3.3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-09-07 20:15

Updated : 2021-09-10 19:57

NVD link : CVE-2021-38707

Mitre link : CVE-2021-38707

CVE.ORG link : CVE-2021-38707

JSON object : View

Products Affected

cliniccases

cliniccases

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-38707", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-09-07T20:15:08.147", "references": [{"url": "https://github.com/judsonmitchell/ClinicCases/releases", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/sudonoodle/CVE-2021-38707", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft."}, {"lang": "es", "value": "Unas vulnerabilidades persistentes de tipo cross-site scripting (XSS) en ClinicCases versi\u00f3n 7.3.3, permiten a atacantes pocos privilegiados introducir JavaScript arbitrario en los par\u00e1metros account. Las cargas \u00fatiles de tipo XSS ser\u00e1n ejecutadas en el navegador de cualquier usuario que visualice el contenido correspondiente. Esto puede resultar en una toma de posesi\u00f3n de la cuenta por medio del robo de tokens de sesi\u00f3n"}], "lastModified": "2021-09-10T19:57:40.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cliniccases:cliniccases:7.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B592D4CE-7412-48C9-9B52-08A0EF43FFFD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}