Vulnerability · Published Jan 5, 2023 · Assigned by VulDB

CVE-2021-4303shannah Xataface Installer install_form.js.php testftp cross site scripting

Low 2.0

In plain English

A low-severity cross-site scripting in Xataface from shannah. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.0Low

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 3.0.0 is able to address this issue. The patch is identified as 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	xataface/xataface	3.0.0	GHSA-64wv-c7jw-jw2q

Affected products (as reported)

Vendor	Product	Versions
shannah	Xataface	2.x

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

References

https://vuldb.com/?id.217442 vdb-entry, technical-description
https://vuldb.com/?ctiid.217442 signature, permissions-required
https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde patch
https://github.com/shannah/xataface/releases/tag/3.0.0 patch