CVE-2020-4070CWE-79
Cross-site Scripting in CSS Validator
Medium · published June 22, 2020
What it is
In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.
The record
Technical detail
- CVSS v3.1
- 4.6 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00550 · 45.3th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2020-06-22T15:40Z
EPSS history
Timeline