CVE-2020-14271

Опубликовано: 18 дек. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content. An unauthenticated remote attacker could exploit this vulnerability using specially-crafted markup to execute script in a victim's web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Ссылки

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085892
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085892
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*

Версия от 9.0 (включая) до 10.0.1 (исключая)

cpe:2.3:a:hcltech:hcl_inotes:*:*:*:*:*:*:*:*

Версия от 11.0.0 (включая) до 11.0.1 (исключая)

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:-:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack1:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack2:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack3:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack4:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:10.0.1:fixpack5:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:11.0.1:-:*:*:*:*:*:*

cpe:2.3:a:hcltech:hcl_inotes:11.0.1:fixpack1:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00766

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-rxm3-3v27-86hh

github

больше 3 лет назад