CVE-2020-8496

Опубликовано: 30 янв. 2020

Источник: nvd

CVSS3: 6.9

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0, there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.

Ссылки

http://www.nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webta
Exploit
Third Party Advisory
https://www.kronos.com/products/kronos-webta
Product
Vendor Advisory
http://www.nolanbkennedy.com/post/stored-xss-2-in-kronos-web-time-and-attendance-webta
Exploit
Third Party Advisory
https://www.kronos.com/products/kronos-webta
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:kronos:web_time_and_attendance:*:*:*:*:*:*:*:*

Версия от 4.1.26 (включая) до 5.0 (исключая)

cpe:2.3:a:kronos:web_time_and_attendance:4.1.17:r1:*:*:*:*:*:*

EPSS

Процентиль: 53%

0.003

Низкий

6.9 Medium

CVSS3

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-33xx-v6xh-7w9j

github

больше 3 лет назад

EPSS

Процентиль: 53%

0.003

Низкий

6.9 Medium

CVSS3

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79