CVE-2020-35724

Опубликовано: 11 янв. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr, tcp, or abs parameter). NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Ссылки

https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
Exploit
Third Party Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
Exploit
Third Party Advisory
https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
Exploit
Third Party Advisory
https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:quest:policy_authority_for_unified_communications:8.1.2.200:*:*:*:*:*:*:*

EPSS

Процентиль: 35%

0.00145

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-9rgw-grwc-587p