{"id":"CVE-2021-35489","aliases":["EUVD-2021-22131","GHSA-6642-wv2w-7c29"],"status":"published","title":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]...","description":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]\u0026backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00861,"percentile":0.58792,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-11-09T22:28:52Z","modified":"2026-06-17T03:57:33Z","products":[{"vendor":"thruk","product":"thruk"}],"references":[{"url":"https://www.gruppotim.it/redteam","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.thruk.org/changelog.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35489"},{"url":"https://github.com/advisories/GHSA-6642-wv2w-7c29"}],"sources":{"cve":[{"id":"CVE-2021-35489","description":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]\u0026backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.","status":"published","published":"2021-11-09T22:28:52Z","modified":"2024-08-04T00:40:47.244Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-22131","description":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]\u0026backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.","status":"published","published":"2021-11-09T22:28:52Z","modified":"2024-08-04T00:40:47Z","updated_at":"2026-11-03T03:24:30.441845Z"}],"ghsa":[{"id":"GHSA-6642-wv2w-7c29","title":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]...","description":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]\u0026backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.","status":"published","published":"2022-05-24T19:20:26Z","modified":"2023-01-30T05:03:53Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:55.674273Z"}],"nvd":[{"id":"CVE-2021-35489","description":"Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2\u0026host={HOSTNAME]\u0026service={SERVICENAME]\u0026backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.","status":"published","published":"2021-11-09T23:15:08.83Z","modified":"2026-06-17T03:57:33.887Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:00.984108Z"}]}}