Vulnerability Details CVE-2021-45228
An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 41.8%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
- https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-031.txt
- https://appsource.microsoft.com/en-us/product/web-apps/constructionindustrysolutionslimited-5057232.coinsconstructioncloud?tab=overview
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-031.txt
Products affected by CVE-2021-45228
-
cpe:2.3:a:coins-global:coins_construction_cloud:11.12