CVE-2020-26505

MEDIUM

6.1

Description

A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.

Details CVE

Score CVSS v3.16.1

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie11/5/2020

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

marmind:marmind

Faiblesses (CWE)

CWE-79

References

https://www.marmind.com/en/(cve@mitre.org)

https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1(cve@mitre.org)

https://www.marmind.com/en/(af854a3a-2127-422b-91ae-364da2661108)

https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.