Stored XSS in Search Function in TopEase
Vulnerability Description
Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-42119
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- SIX Group Services AG, Cyber Controls
More from Business-DNA Solutions GmbH
View All →Affected Vendor
Business-DNA Solutions GmbH
View all reports →