CVE-2020-15951

MEDIUM

6.1

Descripcion

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal credentials.

Detalles CVE

Puntuacion CVSS v3.16.1

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado11/5/2020

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

immuta:immuta

Debilidades (CWE)

CWE-79

Referencias

https://labs.bishopfox.com/advisories(cve@mitre.org)

https://labs.bishopfox.com/advisories/immuta-version-2.8.2(cve@mitre.org)

https://www.immuta.com/(cve@mitre.org)

https://labs.bishopfox.com/advisories(af854a3a-2127-422b-91ae-364da2661108)

https://labs.bishopfox.com/advisories/immuta-version-2.8.2(af854a3a-2127-422b-91ae-364da2661108)

https://www.immuta.com/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.