CVE-2021-35489 | BDVDB-2026-164021 Detail

Description#

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.gruppotim.it/redteam
https://www.thruk.org/changelog.html

Exploit#

No public exploit known

History#

Version 12021-11-09Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.