PT-2020-16347 · Touchbase.Ai · Touchbase.Ai

Puncsky · Published 2020-11-11 · Updated 2020-11-17 · CVE-2020-26218

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions touchbase.ai versions prior to 2.0

Description The issue allows an attacker to inject HTML payloads, which could result in defacement, user redirection to a malicious webpage or website.

Recommendations For versions prior to 2.0, update to version 2.0 to resolve the issue. As a temporary workaround, consider restricting user input to prevent HTML payload injection until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2020-26218

GHSA-R4W5-GW36-4792

Affected Products

Touchbase.Ai

References · 7

• 🔥 https://exploit-db.com/exploits/49040 · Exploit
• https://osv.dev/vulnerability/CVE-2020-26218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26218 · Security Note
• https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792 · Note
• https://t.me/cvenotify/5556 · Telegram Post
• https://t.me/cibsecurity/16186 · Telegram Post
• https://t.me/cvenotify/5705 · Telegram Post