Wocu Monitoring stored Cross-Site Scripting (XSS)

The primary impact of CVE-2021-4035 is the potential for an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the Wocu Monitoring interface. Because the vulnerability is stored, an attacker only needs to inject the malicious script once; subsequent users viewing the affected report comment will also be vulnerable. The blast radius is limited to users with privileges to view and edit reports, but the consequences of a successful attack can be significant, particularly if those users have elevated access rights within the organization.

Organizations utilizing Wocu Monitoring for system monitoring and reporting, particularly those with users who have permissions to create and edit reports, are at risk. Environments running older, unpatched versions (0.27 - 48.1) are especially vulnerable.

1. 2022-02-11Disclosure

   disclosure

1. Gereserveerd2021-11-30
2. Gepubliceerd2022-02-11
3. Gewijzigd2024-09-16
4. EPSS bijgewerkt2026-04-02

The recommended mitigation for CVE-2021-4035 is to immediately upgrade Wocu Monitoring to version 48.2 or later, which includes a patched version of the TinyMCE editor. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all user-supplied data, particularly within the report comment field. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of protection. Regularly review and update the TinyMCE editor to ensure it is running the latest version with security patches.