Security Advisory

CVE-2021-20116

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2021-08-05 20:38:27

Last updated 2024-08-03 17:30:07

Assigner tenable

State PUBLISHED

Description

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir parameters in tce_select_mediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link which, if triggered by an administrator, could result in the attacker hijacking the victims session or performing actions on their behalf.

← Browse all CVEs View on cve.org ↗