{"containers": {"cna": {"affected": [{"product": "GROWI (v4.2 Series)", "vendor": "WESEEK, Inc.", "versions": [{"status": "affected", "version": "versions from v4.2.0 to v4.2.7"}]}], "descriptions": [{"lang": "en", "value": "Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-10T09:20:34", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN86438134/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2021-20672", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GROWI (v4.2 Series)", "version": {"version_data": [{"version_value": "versions from v4.2.0 to v4.2.7"}]}}]}, "vendor_name": "WESEEK, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-site scripting"}]}]}, "references": {"reference_data": [{"name": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/", "refsource": "MISC", "url": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/"}, {"name": "https://jvn.jp/en/jp/JVN86438134/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN86438134/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:45.518Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/en/jp/JVN86438134/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2021-20672", "datePublished": "2021-03-10T09:20:34", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:45:45.518Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:weseek:growi:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF992FE7-A7D2-4FD9-ACF4-3B2B41287F2B", "versionEndIncluding": "4.2.7", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-site scripting reflejado debido a una comprobaci\u00f3n insuficiente de los par\u00e1metros de consulta URL en GROWI (serie v4.2) versiones desde v4.2.0 hasta v4.2.7, permite a atacantes remotos inyectar un script arbitrario por medio de vectores no especificados"}], "id": "CVE-2021-20672", "lastModified": "2024-11-21T05:46:58.933", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2021-03-10T10:15:12.957", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN86438134/index.html"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN86438134/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://weseek.co.jp/security/2021/03/09/vulnerability/growi-prevent-xss5/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}

{}