CVE-2020-19295

MEDIUMNuclei

Jeesns 1.4.2 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-19295 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMJeesns 1.4.2 - Cross-Site ScriptingCVSS 6.1

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /weibo/topic component and allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade Jeesns to the latest version or apply the vendor-provided patch to fix the XSS vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020jeesnsxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:jeesns:jeesns:1.4.2:*:*:*:*:*:*:*
FOFA: title="Jeesns"
FOFA: title="jeesns"
https://github.com/zchuanzhao/jeesns/issues/21 https://www.seebug.org/vuldb/ssvid-97950 https://nvd.nist.gov/vuln/detail/CVE-2020-19295 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3