CVE-2021-42703 - OpenCVE

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Advantech	Webaccess Hmi Designer

Configuration 1 [-]

cpe:2.3:a:advantech:webaccess_hmi_designer:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2021-11-15T14:03:50.578603Z

Updated: 2024-09-17T00:22:02.697Z

Reserved: 2021-10-18T00:00:00

Link: CVE-2021-42703

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-11-15T15:15:06.810

Modified: 2021-11-16T20:35:20.630

Link: CVE-2021-42703

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "HMI Designer", "vendor": "Advantech", "versions": [{"lessThanOrEqual": "2.1.11.0", "status": "affected", "version": "All versions", "versionType": "custom"}]}], "datePublic": "2021-11-09T00:00:00", "descriptions": [{"lang": "en", "value": "This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user\u2019s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-15T14:03:50", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01"}], "source": {"discovery": "UNKNOWN"}, "title": "AzeoTech DAQFactory", "workarounds": [{"lang": "en", "value": "Advantech recommends users update to the latest version of WebAccess HMI Designer v2.1.11.0\n\nSpecific questions should be directed to Advantech customer service"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2021-11-09T19:12:00.000Z", "ID": "CVE-2021-42703", "STATE": "PUBLIC", "TITLE": "AzeoTech DAQFactory"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HMI Designer", "version": {"version_data": [{"version_affected": "<=", "version_name": "All versions", "version_value": "2.1.11.0"}]}}]}, "vendor_name": "Advantech"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user\u2019s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01", "refsource": "MISC", "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Advantech recommends users update to the latest version of WebAccess HMI Designer v2.1.11.0\n\nSpecific questions should be directed to Advantech customer service"}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:38:49.528Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2021-42703", "datePublished": "2021-11-15T14:03:50.578603Z", "dateReserved": "2021-10-18T00:00:00", "dateUpdated": "2024-09-17T00:22:02.697Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:advantech:webaccess_hmi_designer:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB43B171-7CAA-4DDD-ACD5-BF80EB77315E", "versionEndExcluding": "2.1.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user\u2019s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action."}, {"lang": "es", "value": "Esta vulnerabilidad podr\u00eda permitir a un atacante enviar c\u00f3digo Javascript malicioso resultando en el secuestro de los tokens de cookies/sesi\u00f3n del usuario, redirigiendo al usuario a una p\u00e1gina web maliciosa y llevando a cabo una acci\u00f3n no deseada en el navegador"}], "id": "CVE-2021-42703", "lastModified": "2021-11-16T20:35:20.630", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2021-11-15T15:15:06.810", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}