CVE-2020-13639

outsystems lifetime management console, outsystems, outsystems platform server

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-13639

Katalog CVE

CVSS 6.1 · Medium EPSS 0,82%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada outsystems lifetime management console, outsystems +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.

Rincian

Terbit di NVD
31 Agustus 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
outsystems lifetime management console Versi 11 hingga sebelum 11.7.0
outsystems outsystems Versi 10 hingga sebelum 10.0.1005.2
outsystems platform server Versi 11 hingga sebelum 11.9.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.