CVE-2021-21746 - OpenCVE

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Zte	Mf971r Mf971r Firmware

Configuration 1 [-]

AND

cpe:2.3:o:zte:mf971r_firmware:v1.0.0b05:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:zte:mf971r_firmware:1v1.0.0b06:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:zte:mf971r_firmware:2v1.0.0b03:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:zte:mf971r_firmware:s2v1.0.0b03:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:zte:mf971r_firmware:sv1.0.0b05:*:*:*:*:*:*:*

cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*

References

Link	Resource
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: zte

Published: 2021-10-20T14:34:39

Updated: 2021-10-20T14:34:39

Reserved: 2021-01-04T00:00:00

Link: CVE-2021-21746

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-10-20T15:15:07.673

Modified: 2021-10-25T15:27:05.327

Link: CVE-2021-21746

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf971r_firmware:v1.0.0b05:*:*:*:*:*:*:*", "matchCriteriaId": "72A4F659-C656-47D6-B38E-5BA8E73DCD30", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A7F54F4-E324-4D1E-839E-677396BAFE49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf971r_firmware:1v1.0.0b06:*:*:*:*:*:*:*", "matchCriteriaId": "35FA4400-636F-48E7-AF1E-9416D9E9386F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A7F54F4-E324-4D1E-839E-677396BAFE49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf971r_firmware:2v1.0.0b03:*:*:*:*:*:*:*", "matchCriteriaId": "252BBFAA-0053-441A-8F20-A737EF573355", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A7F54F4-E324-4D1E-839E-677396BAFE49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf971r_firmware:s2v1.0.0b03:*:*:*:*:*:*:*", "matchCriteriaId": "7B066F08-DDC4-4868-8FD2-620E46660B64", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A7F54F4-E324-4D1E-839E-677396BAFE49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:mf971r_firmware:sv1.0.0b05:*:*:*:*:*:*:*", "matchCriteriaId": "AAA1BD70-DC47-4B81-A906-3FD76E593F75", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:mf971r:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A7F54F4-E324-4D1E-839E-677396BAFE49", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information."}, {"lang": "es", "value": "El producto ZTE MF971R presenta una vulnerabilidad de tipo XSS reflexiva. Un atacante podr\u00eda usar la vulnerabilidad para conseguir informaci\u00f3n de las cookies"}], "id": "CVE-2021-21746", "lastModified": "2021-10-25T15:27:05.327", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-20T15:15:07.673", "references": [{"source": "psirt@zte.com.cn", "tags": ["Vendor Advisory"], "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}