CVE-2020-14024

Опубликовано: 22 сент. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuration, or (4) any GET Parameter in the /default URL of the application.

Ссылки

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14024-Multiple%20XSS-Ozeki%20SMS%20Gateway
Exploit
Third Party Advisory
https://www.ozeki.hu/index.php?owpn=231
Product
Vendor Advisory
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14024-Multiple%20XSS-Ozeki%20SMS%20Gateway
Exploit
Third Party Advisory
https://www.ozeki.hu/index.php?owpn=231
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ozeki:ozeki_ng_sms_gateway:*:*:*:*:*:*:*:*

Версия до 4.17.6 (включая)

EPSS

Процентиль: 59%

0.00389

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-67pm-3c62-w89c

github

больше 3 лет назад