Vulnerability · Published Nov 30, 2021 · Assigned by NCSC.ch

CVE-2021-42118Stored XSS in TopEase

High 8.1

In plain English

A high-severity cross-site scripting in TopEase from Business-DNA Solutions GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribute, which is then rendered in the Structure Component, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

Affected products (as reported)

Vendor	Product	Versions
Business-DNA Solutions GmbH	TopEase	unspecified – through 7.1.27

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://confluence.topease.ch/confluence/display/DOC/Release+Notes x_refsource_CONFIRM