Description
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly.
Unscored
CVE-2021-21494
EUVD-2021-8767GHSA-w46m-mpvw-cv2h
MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (se…
Published Jan 4, 2021 · Updated Aug 3, 2024 · Assigned by mitre