PT-2020-16426 · Marmind · Marmind

Published 2020-11-05 · Updated 2020-11-09 · CVE-2020-26505

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Marmind version 4.1.141.0

Description A Stored Cross-Site Scripting (XSS) issue in the Marmind web application allows an attacker to inject code that will be executed by legitimate users when they open assets containing JavaScript code. This enables the attacker to perform unauthorized actions on behalf of legitimate users or spread malware via the application. The "Assets Upload" function can be abused to upload a malicious PDF file containing a stored XSS.

Recommendations For version 4.1.141.0, consider disabling the "Assets Upload" function until a patch is available to prevent the upload of malicious files. Restrict access to uploaded assets to minimize the risk of exploitation. Avoid using the application to open or interact with potentially malicious assets until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26505

Affected Products

Marmind

References · 6

• 🔥 https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26505 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26505 · Vendor Advisory
• https://marmind.com/en · Vendor Advisory
• https://t.me/cvenotify/5199 · Telegram Post
• https://t.me/cvenotify/5200 · Telegram Post