Cross-Site Scripting in EPSON EPS TSE Server 8
CVE-2020-28930

5.4MEDIUM

Key Information:

Vendor

Epson

Status
Eps Tse Server 8 Firmware
Vendor
CVE Published:
16 December 2020

What is CVE-2020-28930?

A vulnerability exists in the EPSON EPS TSE Server 8 (21.0.11), where an authenticated attacker can exploit the 'update user' and 'delete user' functionalities in the settings/users.php page. This can lead to the injection of harmful JavaScript payloads that execute within the context of the administrator's session, potentially compromising sensitive admin controls and user data.

References

https://blog.bssi.fr/multiple-vulnerabilities-within-epso...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.