CVE-2020-14413

MEDIUMNuclei

NeDi 1.9C - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-14413 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMNeDi 1.9C - Cross-Site ScriptingCVSS 6.1

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a patched version of NeDi or apply the vendor-supplied patch to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020nedixssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:nedi:nedi:1.9c:*:*:*:*:*:*:*
https://gist.github.com/farid007/8db2ab5367ba00e87f9479b32d46fea8 https://nvd.nist.gov/vuln/detail/CVE-2020-14413 https://github.com/ARPSyndicate/kenzer-templates https://github.com/Elsfa7-110/kenzer-templates

Source: ProjectDiscovery

References

2