CVE-2021-35489

Published: Nov 9, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.

Affected (1)

Products: Thruk: Thruk

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Thruk Thruk	Version 2.40-2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://www.gruppotim.it/redteam

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.thruk.org/changelog.html

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.gruppotim.it/redteam

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.thruk.org/changelog.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.