What’s Vulnerable › Vulnerabilities

CVE-2021-35059

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-11 · updated 2026-06-17
• Weakness: CWE-79

Description

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.

Affected products

• Openwaygroup Way4: before 1.2.278-2693 — fixed in 1.2.278-2693

How to fix

Upgrade to a fixed version: Openwaygroup Way4 1.2.278-2693. Check the vendor advisory for mitigations.

References

• https://gist.github.com/exviry/560fededd1e44b7cced483d8ca8c362e
• https://www.openwaygroup.com/way4-platform
• https://gist.github.com/exviry/560fededd1e44b7cced483d8ca8c362e
• https://www.openwaygroup.com/way4-platform

Get alerted when CVE-2021-35059 or the next vulnerability affects your stack