CVE-2020-15263CWE-79

XSS in platform

High · published October 19, 2020

CVSS v3.1
8.0
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00748 · 54.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-10-19T20:35Z
EPSS history
Timeline
  • 19 OCT 20:35Z
    XSS in platform
    cvelistv5