CVE-2020-15497: jalios jcms

csirt@kutim:~/threat-intel/cve/CVE-2020-15497

CVSS 6.1 · Medium EPSS 1,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada jalios jcms. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. Note: It is asserted that this vulnerability is not present in the standard installation of Jalios JCMS

Rincian

Terbit di NVD: 17 Juli 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,3% peluang dieksploitasi; lebih tinggi dari 68,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jalios	jcms	Versi 10.0.2 build-20200224104759

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.jalios.com/jcms/j_6/en/home advisory vendor
https://pastebin.com/KSJJu5Nx exploit · advisory pihak ketiga
https://twitter.com/joker2a1 not applicable · advisory pihak ketiga
https://github.com/Da2Duo not applicable

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.