CVE-2020-24901

The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html…

Medium · published January 7, 2021

CVSS v3.1
6.1
EPSS
4%
Percentile
90.7
In the wild
Unconfirmed
What it is

The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.04117 · 90.7th percentile
Published
2021-01-07T12:43Z
EPSS history
Timeline
  • 07 JAN 12:43Z
    The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html…
    cvelistv5