PT-2020-13758 · Sage · Sage Easypay

Published 2020-10-18 · Updated 2020-10-27 · CVE-2020-13893

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sage EasyPay version 10.7.5.10

Description The issue allows authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E). This is a stored cross-site scripting (XSS) issue.

Recommendations For Sage EasyPay version 10.7.5.10, consider restricting access to parameters that allow Unicode Transformations (Best-fit Mapping) to minimize the risk of exploitation. As a temporary workaround, avoid using parameters that can be used to inject arbitrary web script or HTML until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13893

Affected Products

Sage Easypay

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-13893 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13893 · Vendor Advisory
• https://sage.com/en-sg/products/sage-easypay · Vendor Advisory
• https://t.me/cibsecurity/15359 · Telegram Post
• https://gist.github.com/picar0jsu/4532a6d15e8f8d7597b7dca5136ad655 · Note