CVE-2020-7051

Katalog CVE

CVSS 6.1 · Medium EPSS 0,76%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada codologic codoforum. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.

Rincian

Terbit di NVD

13 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 53,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://codologic.com/forum/index.php?u=/topic/12638/codoforum-4-8-8-released-and-the-future#post-23845 advisory vendor
• https://www.linkedin.com/posts/polina-voronina-896819b5_discovered-by-polina-voronina-jan-15-activity-66344360... advisory pihak ketiga