CVE-2020-29025CWE-79

DOM-based Javascript injection

Medium · published February 16, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00609 · 48.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-02-16T15:45Z
EPSS history
Timeline
  • 16 FEB 15:45Z
    DOM-based Javascript injection
    cvelistv5