Squirro Insights Engine におけるクロスサイトスクリプティングの脆弱性
| Title |
Squirro Insights Engine におけるクロスサイトスクリプティングの脆弱性
|
| Summary |
Squirro Insights Engine には、クロスサイトスクリプティングの脆弱性が存在します。
|
| Possible impacts |
情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
March 9, 2021, midnight |
| Registration Date |
Dec. 15, 2021, 2:27 p.m. |
| Last Update |
Dec. 15, 2021, 2:27 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.1
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
CVSS2.0 : 警告
|
| Score |
4.3
|
| Vector |
AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected System
| Squirro |
|
Squirro 2.0.0 から 3.2.4
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年12月15日]
掲載 |
Dec. 15, 2021, 11:31 a.m. |
NVD Vulnerability Information
CVE-2021-27945
| Summary |
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
|
| Publication Date |
April 9, 2021, 2:15 a.m. |
| Registration Date |
April 9, 2021, 10:03 a.m. |
| Last Update |
Nov. 21, 2024, 2:58 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:squirro:squirro:*:*:*:*:*:*:*:* |
2.0.0 |
3.2.4 |
|
|
Related information, measures and tools
Common Vulnerabilities List