CVE-2021-37470

EUVD-2021-24035
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
nchsoftwarewebdictate
𝑥
≤ 2.13
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md
https://www.nch.com.au/webdictate/index.html
https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md
https://www.nch.com.au/webdictate/index.html