Persistent XSS vulnerability in filename of attached file in PrivateBin
CVE-2020-5223

6.1MEDIUM

Key Information:

Vendor

Privatebin

Status
Privatebin
Vendor
CVE Published:
23 January 2020

What is CVE-2020-5223?

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.

Affected Version(s)

PrivateBin >= 1.2.0, < 1.2.2 < 1.2.0, 1.2.2

PrivateBin >= 1.3.0, < 1.3.2 < 1.3.0, 1.3.2

References

https://github.com/PrivateBin/PrivateBin/security/advisor...
x_refsource_CONFIRM
https://privatebin.info/news/v1.3.2-v1.2.2-release.html
x_refsource_MISC
https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.