← Back to CVE List

CVE-2021-21494

Published: 2021-01-04T03:15Z
Last Modified: 2024-11-21T05:48Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt