Details of VAR-202301-0102

ID

VAR-202301-0102

CVE

CVE-2021-41823

TITLE

Web Application Firewall Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-004101

DESCRIPTION

The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism. Web Application Firewall (WAF) Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2021-41823 // JVNDB: JVNDB-2022-004101 // VULHUB: VHN-402961 // VULMON: CVE-2021-41823

AFFECTED PRODUCTS

vendor:	kemptechnologies	model:	web application firewall	scope:	eq	version:	7.2.54.1	Trust: 1.0
vendor:	kemp	model:	web application firewall	scope:	eq	version:	7.2.54.1	Trust: 0.8
vendor:	kemp	model:	web application firewall	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-004101 // NVD: CVE-2021-41823

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-41823
value:	MEDIUM
Trust: 1.0
134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2021-41823
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-41823
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202301-017
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2021-41823
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.1
Trust: 2.0
NVD:	CVE-2021-41823
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-004101 // CNNVD: CNNVD-202301-017 // NVD: CVE-2021-41823 // NVD: CVE-2021-41823

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.1
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-402961 // JVNDB: JVNDB-2022-004101 // NVD: CVE-2021-41823

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202301-017

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202301-017

PATCH

title:

Kemp Web Application Firewall (WAF)

url:

https://kemptechnologies.com/en/solutions/waf

Trust: 0.8

sources: JVNDB: JVNDB-2022-004101

EXTERNAL IDS

db:	NVD	id:	CVE-2021-41823	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-004101	Trust: 0.8
db:	CNNVD	id:	CNNVD-202301-017	Trust: 0.6
db:	VULHUB	id:	VHN-402961	Trust: 0.1
db:	VULMON	id:	CVE-2021-41823	Trust: 0.1

sources: VULHUB: VHN-402961 // VULMON: CVE-2021-41823 // JVNDB: JVNDB-2022-004101 // CNNVD: CNNVD-202301-017 // NVD: CVE-2021-41823

REFERENCES

url:	https://pastebin.com/kpx9nvbf	Trust: 2.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-41823	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2021-41823/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-402961 // VULMON: CVE-2021-41823 // JVNDB: JVNDB-2022-004101 // CNNVD: CNNVD-202301-017 // NVD: CVE-2021-41823

SOURCES

db:	VULHUB	id:	VHN-402961
db:	VULMON	id:	CVE-2021-41823
db:	JVNDB	id:	JVNDB-2022-004101
db:	CNNVD	id:	CNNVD-202301-017
db:	NVD	id:	CVE-2021-41823

LAST UPDATE DATE

2025-04-11T23:15:12.549000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-402961	date:	2023-01-09T00:00:00
db:	VULMON	id:	CVE-2021-41823	date:	2023-01-02T00:00:00
db:	JVNDB	id:	JVNDB-2022-004101	date:	2023-03-20T02:28:00
db:	CNNVD	id:	CNNVD-202301-017	date:	2023-01-13T00:00:00
db:	NVD	id:	CVE-2021-41823	date:	2025-04-11T15:15:39.270

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-402961	date:	2023-01-01T00:00:00
db:	VULMON	id:	CVE-2021-41823	date:	2023-01-01T00:00:00
db:	JVNDB	id:	JVNDB-2022-004101	date:	2023-03-20T00:00:00
db:	CNNVD	id:	CNNVD-202301-017	date:	2023-01-01T00:00:00
db:	NVD	id:	CVE-2021-41823	date:	2023-01-01T06:15:09.283