PT-2020-14323 · Xplatform · Xplatform

Hightabuna · Published 2020-10-19 · Updated 2020-10-22 · CVE-2020-15263

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Platform versions 9.0.0 through 9.4.3

Description The issue arises from inline attributes not being properly escaped, potentially leading to an XSS vulnerability if user-provided data is not escaped. This could allow for malicious script execution.

Recommendations For versions 9.0.0 through 9.4.3, update to version 9.4.4 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15263

GHSA-589W-HCCM-265X

Affected Products

Xplatform

References · 5

• https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15263 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15263 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-589w-hccm-265x · Vendor Advisory
• https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x · Note