CVE-2021-43810 HIGH

CVE-2021-43810: Cross-site Scripting (XSS) when redirect an url

Vendor Admidio
Product admidio
Weakness CWE-79 · XSS
Published December 7, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12.

Key dates

02Disclosure timeline

December 7, 2021 CVE published
August 4, 2024 Record updated