title: ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS
description: The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: ShinHer StudyOnline System
vendor: ShinHer Information Co., LTD.
versions:
lessThanOrEqual: 2021, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
solutions: Update ShinHer StudyOnline System to version v2021.08.20.01