PT-2022-8907 · Unknown · Xcss Valine

Soffm · Published 2022-04-05 · Updated 2022-04-12 · CVE-2020-28847

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions xCss Valine version 1.4.14

Description A Cross Site Scripting (XSS) issue exists in xCss Valine via the nick parameter to the "/classes/Comment" endpoint. This allows for potential malicious script execution. The estimated number of potentially affected devices and details about real-world incidents where this issue was exploited are not provided.

Recommendations For xCss Valine version 1.4.14, update to version 1.4.15 to resolve the issue. As a temporary workaround, consider restricting access to the /classes/Comment endpoint or avoiding the use of the nick parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-28847

GHSA-6XVQ-2GJ8-4276

Affected Products

Xcss Valine

References · 8

• https://osv.dev/vulnerability/GHSA-6xvq-2gj8-4276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28847 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28847 · Vendor Advisory
• https://github.com/xCss/Valine/issues/348 · Note
• https://github.com/xCss/Valine/releases/tag/v1.4.15 · Note
• https://github.com/xCss/Valine · Note
• https://t.me/cibsecurity/40173 · Telegram Post
• https://t.me/cvenotify/28467 · Telegram Post