PT-2020-15431 · Mediakind · Rx8200

Published 2020-09-14 · Updated 2020-11-12 · CVE-2020-22158

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaKind (formerly Ericsson) RX8200 version 5.13.3

Description The issue allows for both reflected and stored Cross-Site Scripting (XSS) attacks. An attacker can exploit reflected XSS by injecting JavaScript code into the path or Services+ID parameters and tricking a user into accessing the manipulated URL. For stored XSS, an attacker must modify the name parameter with malicious code to store the exploit on the server, which can then affect other users.

Recommendations For MediaKind (formerly Ericsson) RX8200 version 5.13.3, as a temporary workaround, consider restricting access to the path and Services+ID parameters in the affected API endpoint, and avoid using the name parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-22158

Affected Products

Rx8200

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-22158 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22158 · Vendor Advisory
• https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.html · Note