DOM-based Javascript injection
CVE-2020-29025

5.4MEDIUM

Key Information:

Vendor

Secomea

Status
Sitemanager Embedded (sm-e)
Vendor
CVE Published:
16 February 2021

What is CVE-2020-29025?

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

Affected Version(s)

SiteManager Embedded (SM-E) all all < 9.3

References

https://www.secomea.com/support/cybersecurity-advisory/#3042
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.