CVE-2020-19282

MEDIUMNuclei

Jeesns 1.4.2 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-19282 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMJeesns 1.4.2 - Cross-Site ScriptingCVSS 6.1

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version of Jeesns or apply the vendor-provided patch to fix the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2020cvejeesnsxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:jeesns:jeesns:1.4.2:*:*:*:*:*:*:*
FOFA: title="jeesns"
https://github.com/zchuanzhao/jeesns/issues/11 https://www.seebug.org/vuldb/ssvid-97940 https://nvd.nist.gov/vuln/detail/CVE-2020-19282 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3