CVE-2021-30119

MediumCVSS 5.4

Published: 09/07/2021(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

52.69%

99th percentile - higher than 99% of all known CVEs

Summary

Authenticated reflective XSS was identified in HelpDeskTab/rcResults.asp. The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page, allowing a Cross-Site Scripting attack. The same issue exists for the parameter FileName of /done.asp.

Risk Assessment

An authenticated attacker can exploit the vulnerability to execute scripts in the victim's browser, potentially leading to session theft, account takeover, or unauthorized actions in the context of the logged-in user.

Recommendation

Apply the vendor's patch or manually implement proper output escaping for the result and FileName parameters. Restrict access to these pages to trusted users only.

Original NVD description (English source)

Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`