CVE-2020-9056CWE-79

Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting

Low · published April 10, 2020

CVSS v3.1
3.9
EPSS
1%
Percentile
50.0
In the wild
Unconfirmed
What it is

Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript within the application. This JavaScript is subsequently displayed by the application without sanitization and is executed in the browser of the user, which could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been patched in BuySpeed version 15.3.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00639 · 50.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-04-10T18:35Z
EPSS history
Timeline
  • 10 APR 18:35Z
    Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting
    cvelistv5