PT-2020-13564 · Verint · Verint Workforce Optimization

Published 2020-06-22 · Updated 2021-07-21 · CVE-2020-13480

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Verint Workforce Optimization (WFO) version 15.2

Description The issue allows HTML injection via the "send email" feature. This could potentially lead to malicious activities such as phishing or cross-site scripting (XSS) attacks, where an attacker injects HTML code into a website, which is then executed by the user's browser.

Recommendations For Verint Workforce Optimization (WFO) version 15.2, consider disabling the "send email" feature until a patch is available to prevent potential HTML injection attacks. Restrict access to this feature to minimize the risk of exploitation. Avoid using the "send email" feature in sensitive or untrusted environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13480

Affected Products

Verint Workforce Optimization

References · 6

• 🔥 https://tejaspingulkar.blogspot.com/2020/06/cve-2020-13480-verint-html-injection.html · Exploit
• 🔥 https://youtube.com/watch?v=11ghigOu-K0 · Exploit
• 🔥 http://cvewalkthrough.com/cve-2020-13480html-injection · Exploit
• https://osv.dev/vulnerability/CVE-2020-13480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13480 · Security Note
• https://t.me/cvenotify/4583 · Telegram Post