PT-2020-15930 · Nifty · Nifty Project Management Web Application

Published 2020-09-15 · Updated 2024-08-04 · CVE-2020-25071

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nifty Project Management Web Application (affected versions not specified)

Description The issue allows for XSS via the Add Task feature, which is rendered when visiting the Project Home. The original problem involved creating a task and displaying an alert on the screen. However, it has been argued that this issue is not reproducible, as the task can still be created but the alert will not be executed due to stripped attributes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25071

Affected Products

Nifty Project Management Web Application

References · 6

• 🔥 https://medium.com/@muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7 · Exploit
• https://niftypm.com/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25071 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25071 · Vendor Advisory
• https://medium.com/%40muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7 · Note
• https://t.me/cvenotify/89015 · Telegram Post