PT-2020-17167 · Unknown · Liveaddressplugin.Js

Published 2020-12-11 · Updated 2020-12-14 · CVE-2020-29455

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions liveAddressPlugin.js version 3.2

Description A cross-Site Scripting (XSS) issue in this.showInvalid and this.showInvalidCountry functions of liveAddressPlugin.js allows remote attackers to inject arbitrary web script or HTML via any address parameter, such as street or country.

Recommendations For liveAddressPlugin.js version 3.2, consider disabling the this.showInvalid and this.showInvalidCountry functions as a temporary workaround until a patch is available. Restrict access to address parameters, such as street or country, to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29455

Affected Products

Liveaddressplugin.Js

References · 15

• 🔥 https://guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2020-29455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29455 · Security Note
• https://t.me/cibsecurity/20479 · Telegram Post
• https://t.me/cibsecurity/20498 · Telegram Post
• https://t.me/cibsecurity/20538 · Telegram Post
• https://t.me/cibsecurity/20610 · Telegram Post
• https://t.me/cibsecurity/20630 · Telegram Post
• https://t.me/cvenotify/7040 · Telegram Post
• https://t.me/cibsecurity/20590 · Telegram Post
• https://t.me/cibsecurity/20551 · Telegram Post
• https://github.com/smartystreets-archives · Note
• https://jsfiddle.net/smartystreets/Lx2dbsaa · Note
• https://t.me/cibsecurity/20571 · Telegram Post
• https://t.me/cibsecurity/20518 · Telegram Post