CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS.This issue affects vipdrv: from n/a through <= 1.0.3.
Explanation of Vulnerability in Simple Terms
vipdrv versions 1.0.3 and earlier contain a cross-site scripting (XSS) vulnerability that allows an authenticated high-privilege user to inject malicious scripts. The vulnerability requires user interaction and can affect other users or components. An attacker with high privileges can craft a malicious request that, when visited by a victim, executes arbitrary JavaScript in their browser.
What an attacker can do
Inject malicious JavaScript that executes in other users' browsers when they visit affected pages.
Potential impact on your site
High-privilege accounts can be abused to inject scripts affecting other users; session hijacking or credential theft is possible.
Conditions required to exploit
Attacker must have high-level privileges in the application and the victim must visit a crafted link or page.
Key dates
External resources
