Vulnerabilities

TI-2021-09133 CVE-2021-27704 · GHSA-pvp4-m7wj-rwq3

Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page.

LOW 29

Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00412 Published 2024-11-12 No fix listed CWE-352

TI-2021-09294 CVE-2021-27990 · GHSA-hwm9-2683-r7jg

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as…

LOW 36

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01436 Published 2021-04-14 No fix listed CWE-287

TI-2021-09293 CVE-2021-27989 · GHSA-42vc-95ph-qmgq

Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters…

LOW 25

Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00499 Published 2021-04-14 No fix listed CWE-79

TI-2021-09115 CVE-2021-27670 · GHSA-3qwh-w55v-784g

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

HIGH 77

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61274 Published 2021-02-25 No fix listed CWE-918

TI-2021-09020 CVE-2021-27564 · GHSA-9pcq-r26w-9482

A stored XSS issue exists in Appspace 6.2.4.

LOW 25

A stored XSS issue exists in Appspace 6.2.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00541 Published 2021-02-22 No fix listed CWE-79

TI-2020-04440 CVE-2020-5393 · GHSA-rfpg-5qm4-95q2

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.

LOW 28

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00709 Published 2020-01-07 No fix listed CWE-79

Vulnerabilities

Filters

Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page.

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as…

Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters…

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.

A stored XSS issue exists in Appspace 6.2.4.

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS.