PT-2021-11632 · Unknown · Sitemanager-Embedded

Published 2021-02-16 · Updated 2021-02-20 · CVE-2020-29025

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SiteManager-Embedded (SM-E) versions prior to 9.3

Description: A vulnerability in the SiteManager-Embedded (SM-E) Web server may allow an attacker to construct a URL that, if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

Recommendations: For versions prior to 9.3, update to version 9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the web application to minimize the risk of exploitation. Avoid using URLs that could be manipulated by an attacker to execute malicious JavaScript code.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-29025

Affected Products

Sitemanager-Embedded

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-29025 · Security Note
• https://secomea.com/support/cybersecurity-advisory/#3042 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29025 · Vendor Advisory
• https://t.me/cvenotify/10180 · Telegram Post
• https://t.me/cibsecurity/23647 · Telegram Post