PT-2020-16077 · Intermind · Intermind Imind Server

H3Llraiser · Published 2020-11-05 · Updated 2021-07-21 · CVE-2020-25399

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InterMind iMind Server versions through 3.13.65

Description The issue allows any user to hijack another user's session by sending a malicious file in the chat, due to a stored XSS vulnerability.

Recommendations For versions through 3.13.65, update to a version that contains a fix for this issue to prevent session hijacking.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25399

Affected Products

Intermind Imind Server

References · 3

• 🔥 https://github.com/h3llraiser/CVE-2020-25399 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25399 · Security Note