Vulnerability · Published Nov 30, 2021 · Assigned by NCSC.ch

CVE-2021-42119Stored XSS in Search Function in TopEase

High 7.3

In plain English

A high-severity cross-site scripting in TopEase from Business-DNA Solutions GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rendered in the Search Functionality, to alter the intended functionality and steal cookies, the latter allowing for account takeover.

Affected products (as reported)

Vendor	Product	Versions
Business-DNA Solutions GmbH	TopEase	unspecified – through 7.1.27

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://confluence.topease.ch/confluence/display/DOC/Release+Notes x_refsource_CONFIRM