CVE-2021-43436

{"id": "CVE-2021-43436", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-01-12T17:15:08.237", "references": [{"url": "https://github.com/MartDevelopers-Inc/iResturant", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40mayhem7999/cve-2021-43436-56dc43aeac81", "source": "cve@mitre.org"}, {"url": "https://github.com/MartDevelopers-Inc/iResturant", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://medium.com/%40mayhem7999/cve-2021-43436-56dc43aeac81", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed."}, {"lang": "es", "value": "MartDevelopers Inc iResturant versi\u00f3n v1.0, permite un ataque de tipo XSS almacenado al colocar un payload en el campo username durante un intento de inicio de sesi\u00f3n. Cuando un administrador mira el registro de inicios de sesi\u00f3n fallidos, la carga \u00fatil de tipo XSS se ejecuta"}], "lastModified": "2024-11-21T06:29:13.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iresturant_project:iresturant:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "991B601B-9EB9-4EC2-98B1-AAC81DD96D61"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}