CVE-2020-13639

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications

published August 31, 2021

CVSS
—
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00821 · 56.8th percentile
Published
2021-08-31T03:56Z
EPSS history
Timeline
  • 31 AUG 03:56Z
    A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications
    cvelistv5