Vulnerability · Published Jun 15, 2021 · Assigned by mitre

CVE-2020-21316

Medium 6.1

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.1%top 33.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/94fzb/zrlog/issues/56 x_refsource_MISC
https://gist.github.com/T-pod/d9405dbd61243990d65d55c5df0fcbe6 x_refsource_MISC
https://github.com/94fzb/zrlog/commit/b921c1ae03b8290f438657803eee05226755c941 x_refsource_MISC