Vulnerability · Published Mar 9, 2022 · Assigned by GovTech CSG
CVE-2021-42856Reflected Cross-site Scripting at DsaDataTest
Medium 4.7
In plain English
A medium-severity improper input validation in SteelCentral AppInternals Dynamic Sampling Agent from Aternity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Aternity | SteelCentral AppInternals Dynamic Sampling Agent | 10.x12.13.0 – before 12.13.011.8.8 – before 11.8.8 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N