obs: Stored XSS
CVE-2020-8031

6.3MEDIUM

Key Information:

Vendor

Opensuse
Status
Open Build Service
Vendor
CVE Published:
11 February 2021

What is CVE-2020-8031?

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prior to 2.10.8.

Affected Version(s)

Open Build Service Open Build Service < 2.10.8

References

https://bugzilla.suse.com/show_bug.cgi?id=1178880
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sofia Marakhovich of Huawei
.