PT-2020-16350 · Touchbase.Ai · Touchbase.Ai

Published 2020-11-11 · Updated 2020-11-17 · CVE-2020-26221

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions touchbase.ai versions prior to 2.0

Description The issue allows an attacker to send malicious JavaScript code, which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser actions.

Recommendations For versions prior to 2.0, update to version 2.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive user data and implementing additional security measures to prevent malicious JavaScript code execution.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26221

GHSA-JC3V-H36H-6MX3

Affected Products

Touchbase.Ai

References · 6

• https://osv.dev/vulnerability/CVE-2020-26221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26221 · Security Note
• https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-jc3v-h36h-6mx3 · Note
• https://t.me/cibsecurity/16190 · Telegram Post
• https://t.me/cvenotify/5708 · Telegram Post
• https://t.me/cvenotify/5559 · Telegram Post