fkie_cve-2020-13168
Vulnerability from fkie_nvd
Published
2020-10-02 09:15
Modified
2024-11-21 05:00
Severity ?
Summary
SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/lodestone-security/CVEs/tree/master/CVE-2020-13168 | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.sysaid.com/product/on-premise/latest-release | Product, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/lodestone-security/CVEs/tree/master/CVE-2020-13168 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.sysaid.com/product/on-premise/latest-release | Product, Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "06FE1823-BFD5-4962-81DF-E9F64AAB6DB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:5.5.06:*:*:*:*:*:*:*",
"matchCriteriaId": "91A2521B-FF58-4DA8-90E0-3BF75AD3FDF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:5.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E913847C-3AFA-4999-895D-2C6491078E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:6.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "21FB32A4-8AC9-4792-9CBC-0CA5EA1B52A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "52D492A7-24FE-4E5B-B5B4-F1728203BE04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "806D22D9-E588-44FC-A9E3-D4A98F23FC61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6F331EB4-75FE-4A56-B277-315361B598FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E37572B-F084-4E03-920A-3BF01D8DF4E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "567A5AC2-E79D-4D5C-8D11-F67EB0FA2EF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:8.5:*:*:*:*:*:*:*",
"matchCriteriaId": "ECCBD7AB-485D-4DAF-9E68-0EE7EB4D6D37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C460C9D3-036B-4EBF-9175-147A0D0E6B9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.0.30:*:*:*:*:*:*:*",
"matchCriteriaId": "2F2ED427-38F8-4C82-A413-85BB7C8F0AD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.0.40:*:*:*:*:*:*:*",
"matchCriteriaId": "7A91D8D9-A063-42A4-9CBD-982DAD3F0DC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.0.52:*:*:*:*:*:*:*",
"matchCriteriaId": "339F8AAE-4AD1-48BA-A0F3-C512043D7887",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.0.53:*:*:*:*:*:*:*",
"matchCriteriaId": "FF2A4C1D-F997-4C14-B90A-01C499463A0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:9.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DEFDDD8-FAEB-4A85-8F91-74E84C5DBAB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "41914F8F-0AEA-41BD-B0A4-ACECFB68325F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A0672577-D03C-45C8-AF1E-A6B9021D6053",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.3:*:*:*:*:*:*:*",
"matchCriteriaId": "77261E88-0CF6-4A88-A980-733C8A9E35D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.4.00:*:*:*:*:*:*:*",
"matchCriteriaId": "07C9FA4B-4AB4-4038-A179-8B737CD1248D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "AB43ACEA-89EC-4CA6-89F5-AE9336F6F02C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "360F0C4C-C394-4F58-87D8-5EF0E3A0C420",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:14.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E13422DA-8FAD-422C-A31E-CB96704E903D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "907565A7-EE18-443D-98A2-69D83C3868B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.1.30:*:*:*:*:*:*:*",
"matchCriteriaId": "F818F3BC-8579-4C62-A077-4A1922397F33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.1.50:*:*:*:*:*:*:*",
"matchCriteriaId": "067DDBFF-E883-4146-9231-0CCE929DB4D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.1.70:*:*:*:*:*:*:*",
"matchCriteriaId": "ADB6A7F5-EE10-4CD0-A202-3CC96AFECA17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.2.03:*:*:*:*:*:*:*",
"matchCriteriaId": "24DFF64A-3F57-4A70-88B6-F943C41DF505",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.2.04:*:*:*:*:*:*:*",
"matchCriteriaId": "21A40D7F-8C62-4CC9-9649-DBD409505147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:15.2.05:*:*:*:*:*:*:*",
"matchCriteriaId": "684BBD83-CA54-4F82-B21C-8E182ED15E40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:16.3.16:*:*:*:*:*:*:*",
"matchCriteriaId": "68A2FE2C-C4E1-49B7-9D55-64125B5F8E9A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:16.3.17:*:*:*:*:*:*:*",
"matchCriteriaId": "4067152C-7186-431C-A7A9-57925F0C8B7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:17.2.03:*:*:*:*:*:*:*",
"matchCriteriaId": "EFEE384B-E7BE-473D-AB1E-AFD326CD98CF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:17.3.57:*:*:*:*:*:*:*",
"matchCriteriaId": "F08F5A58-6F72-42E5-801D-C0A2435699DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:18.1.54:*:*:*:*:*:*:*",
"matchCriteriaId": "A928860E-626E-4AEA-B573-36DC62E73C90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:19.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C06C45FE-5C69-429C-B3C1-BE00663F7DB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaid_on-premises:19.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2941B784-561D-4FD5-92C9-189E4721B7D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sysaid:sysaidsy_on-premises:20.1.11:b26:*:*:*:*:*:*",
"matchCriteriaId": "6CADF5B1-6A52-4F22-81B3-97EB50EC2F5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter."
},
{
"lang": "es",
"value": "SysAid versi\u00f3n 20.1.11b26, permite un ataque de tipo XSS reflejado por medio del par\u00e1metro accountid del archivo ForgotPassword.jsp"
}
],
"id": "CVE-2020-13168",
"lastModified": "2024-11-21T05:00:47.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-02T09:15:13.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/lodestone-security/CVEs/tree/master/CVE-2020-13168"
},
{
"source": "cve@mitre.org",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://www.sysaid.com/product/on-premise/latest-release"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/lodestone-security/CVEs/tree/master/CVE-2020-13168"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://www.sysaid.com/product/on-premise/latest-release"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…