Stored XSS Vulnerability in Archery Project Management Tool by ArcherySec
CVE-2019-20008

5.4MEDIUM

Key Information:

Vendor: Archerysec
Status: Archery
Vendor: CVE Published:; 26 December 2019

What is CVE-2019-20008?

Earlier versions of the Archery project management tool, specifically before 1.3, are susceptible to a stored XSS vulnerability. Attackers can exploit this flaw by inserting malicious XSS payloads into project names. This can happen during the creation of a new project or while editing an existing one. As a result, when users access the vulnerability-scan scheduling page, they unknowingly execute the stored XSS, potentially compromising sensitive data and the integrity of the web application.