« Volver al listado

CVE-2021-20749

Estado: ModificadaMedia (5.4)—

Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Nendeb — Fudousan PluginNendeb — Fudousan Plugin PRO Multi-userNendeb — Fudousan Plugin PRO Single-user

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-20749",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "nendeb",
          "product": "'Fudousan plugin' series",
          "versions": [
            {
              "status": "affected",
              "version": "Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-28T01:15:07.537",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN93799513/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://nendeb.jp/fudou",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.nendeb-biz.jp/2021-0617-1200/",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN93799513/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nendeb.jp/fudou",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.nendeb-biz.jp/2021-0617-1200/",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fudousan Plugin Pro Multi-User Type ver5.7.0 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo cross-site scripting en Fudousan plugin versiones 5.7.0 y anteriores, Fudousan Plugin Pro Single-User Type versiones 5.7.0 y anteriores, y Fudousan Plugin Pro Multi-User Type versiones 5.7.0 y anteriores permite a un atacante remoto autenticado inyectar un script arbitrario por medio de vectores no especificados"
    }
  ],
  "lastModified": "2026-06-17T03:34:22.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nendeb:fudousan_plugin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "337DE73F-FBD8-4D2E-9B74-A4FD23E7EEC6",
              "versionEndIncluding": "5.7.0"
            },
            {
              "criteria": "cpe:2.3:a:nendeb:fudousan_plugin_pro_multi-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C79F955-D3DB-4C26-BE88-600A63161467",
              "versionEndIncluding": "5.7.0"
            },
            {
              "criteria": "cpe:2.3:a:nendeb:fudousan_plugin_pro_single-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06441D52-6BFC-4AD8-835A-0381AFCCFD98",
              "versionEndIncluding": "5.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}