PT-2020-20278 · Synaptive Medical · Clearcanvas Imageserver

Joshua Provoste · Published 2020-02-07 · Updated 2020-02-11 · CVE-2020-8788

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synaptive Medical ClearCanvas ImageServer version 3.0 Alpha

Description The issue allows for XSS and HTML injection via the UserName parameter in the "Default.aspx" endpoint.

Recommendations For Synaptive Medical ClearCanvas ImageServer version 3.0 Alpha, avoid using the UserName parameter in the Default.aspx endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the Default.aspx endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8788

Affected Products

Clearcanvas Imageserver

References · 3

• 🔥 https://github.com/ClearCanvas/ClearCanvas/issues/227 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8788 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8788 · Vendor Advisory