CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS

published February 15, 2020

CVSS
—
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.6th percentile
Published
2020-02-15T17:52Z
EPSS history
Timeline
  • 15 FEB 17:52Z
    Codologic Codoforum through 4.8.4 allows a DOM-based XSS
    cvelistv5