Persistent XSS in markdown parser used by obs-server
CVE-2020-8020

6.5MEDIUM

Key Information:

Vendor

Opensuse
Status
Open-build-service
Vendor
CVE Published:
13 May 2020

What is CVE-2020-8020?

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

open-build-service open-build-service < 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb

References

https://bugzilla.suse.com/show_bug.cgi?id=1171439
x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2021/02/msg0...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Victor Pereira of SUSE
JSON
.