CVE-2021-31537

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-05-11 · updated 2026-06-17
Weakness: CWE-79

Description

SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).

Affected products

Sisinformatik Sis-Rewe Go: before 7.7; 7.7, 7.7-sp16 — fixed in 7.7

How to fix

Upgrade to a fixed version: Sisinformatik Sis-Rewe Go 7.7. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2021/May/20
https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/
https://sisinformatik.com/rewe-go/
http://seclists.org/fulldisclosure/2021/May/20
https://sec-consult.com/vulnerability-lab/advisory/reflected-xss-sis-infromatik-rewe-go-cve-2021-31537/
https://sisinformatik.com/rewe-go/

Get alerted when CVE-2021-31537 or the next vulnerability affects your stack