CVE-2021-20784 - Vulnerability Details - OpenCVE

HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Voidtools	Everything

Configuration 1 [-]

OR	cpe:2.3:a:voidtools:everything::::::::
	cpe:2.3:a:voidtools:everything::::::::
	cpe:2.3:a:voidtools:everything::::::::

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN68971465/
https://jvn.jp/en/jp/JVN68971465/index.html
https://www.voidtools.com/
https://www.voidtools.com/downloads/

History

Tue, 03 Dec 2024 01:45:00 +0000

Type	Values Removed	Values Added
Description	HTTP header injection vulnerability in Everything all versions except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product via unspecified vectors.	HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.
Weaknesses		CWE-644
References		https://jvn.jp/en/jp/JVN68971465/
Metrics		cvssV3_0 `{'score': 6.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2021-07-14T01:20:29

Updated: 2024-12-03T01:14:05.653Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20784

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-07-14T02:15:07.577

Modified: 2024-12-03T02:15:16.550

Link: CVE-2021-20784

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:voidtools:everything:*:*:*:*:*:*:*:*", "matchCriteriaId": "54ED65DC-1DED-4D08-85C0-CB2F6011AA5C", "versionEndExcluding": "1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:voidtools:everything:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6DC1904-72E3-4FB3-A304-678A31B12AF6", "versionEndExcluding": "1.2", "versionStartIncluding": "1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:voidtools:everything:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7D356F0-BA1E-4003-9CAD-4BC94F678B2B", "versionEndExcluding": "1.3", "versionStartIncluding": "1.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de encabezado HTTP en Everything todas las versiones, excepto la versi\u00f3n Lite, puede permitir a un atacante remoto inyectar un script arbitrario o alterar el sitio web que usa el producto por medio de vectores no especificados"}], "id": "CVE-2021-20784", "lastModified": "2024-12-03T02:15:16.550", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-07-14T02:15:07.577", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN68971465/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.voidtools.com/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product", "Vendor Advisory"], "url": "https://www.voidtools.com/downloads/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN68971465/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.voidtools.com/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://www.voidtools.com/downloads/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-644"}], "source": "vultures@jpcert.or.jp", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Secondary"}]}