PT-2020-16081 · Arachnys · Arachnys Cabot

Published 2020-12-04 · Updated 2022-05-24 · CVE-2020-25449

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Arachnys Cabot version 0.11.12

Description The issue is a Cross Site Scripting (XSS) vulnerability that can be exploited via the Address column. This allows for malicious scripts to be injected into the website, potentially leading to unauthorized access or control.

Recommendations For Arachnys Cabot version 0.11.12, update to a version that fixes the XSS vulnerability in the Address column to prevent exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-25449

GHSA-8Q2H-4MQ6-396J

PYSEC-2020-226

Affected Products

Arachnys Cabot

References · 12

• 🔥 https://itsmeanonartist.tech/blogs/blog2.html · Exploit
• 🔥 https://exploitalert.com/view-details.html?id=36106 · Exploit
• 🔥 https://packetstormsecurity.com/files/159070/Cabot-0.11.12-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-25449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25449 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-226 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8q2h-4mq6-396j · Vendor Advisory
• https://github.com/arachnys/cabot · Note
• https://github.com/arachnys/cabot/commit/18708572cb0ed143842409419eada91160413973 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/cabot/PYSEC-2020-226.yaml · Note
• https://t.me/cibsecurity/17168 · Telegram Post
• https://exploit-db.com/exploits/48791 · Note