Reflected XSS in Artica Proxy CE Before 4.28.030.418
CVE-2020-15053

6.1MEDIUM

Key Information:

Vendor

Articatech

Status
Artica Proxy
Vendor
CVE Published:
20 July 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-15053?

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Artica Proxy CE versions prior to 4.28.030.418. This issue arises when user input in search fields such as real-time requests, System Events, Proxy Events, Proxy Objects, and Firewall objects is not properly sanitized. As a result, malicious actors can exploit this flaw to inject executable JavaScript code, leading to potential session hijacking or other security exploits. Users are advised to upgrade to the latest version to mitigate risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-15053
Created by pratikshad19

References

https://github.com/pratikshad19/CVE-2020-15053
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.