CVE-2021-42856

· MEDIUMModified

← All CVEs

CVSS v3.1

4.7

EPSS

0.60%

Published

Mar 10, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-20CWE-79

Affected Products (3)

riverbed · steelcentral_appinternals_dynamic_sampling_agent (up to 11.8.8)vulnerable

riverbed · steelcentral_appinternals_dynamic_sampling_agent (up to 12.13.0)vulnerable

riverbed · steelcentral_appinternals_dynamic_sampling_agentvulnerable

References (2)

https://aternity.force.com/customersuccess/s/article/Reflected-Cross-site-Scripting-at-DsaDataTest-CVE-2021-42856

Third Party Advisory

https://aternity.force.com/customersuccess/s/article/Reflected-Cross-site-Scripting-at-DsaDataTest-CVE-2021-42856

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs