PT-2020-17003 · Dundas · Dundas Bi

Published 2020-11-10 · Updated 2020-11-18 · CVE-2020-28408

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dundas BI versions through 8.0.0.1001

Description The issue allows for cross-site scripting (XSS) via an HTML label when creating or editing a dashboard. This occurs because the server in Dundas BI does not properly validate user input, specifically HTML labels, which can lead to the execution of malicious scripts.

Recommendations For Dundas BI versions through 8.0.0.1001, consider disabling the ability to create or edit dashboards with HTML labels until a patch is available. Restrict access to dashboard creation and editing features to minimize the risk of exploitation. Avoid using HTML labels in dashboards until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28408

Affected Products

Dundas Bi

References · 6

• 🔥 https://mattschmidt.net/2020/11/10/dundas-persistent-xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-28408 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28408 · Vendor Advisory
• https://t.me/cibsecurity/16134 · Telegram Post
• https://t.me/cvenotify/5779 · Telegram Post
• https://t.me/cvenotify/5493 · Telegram Post