CVE-2020-23517

MEDIUMNuclei

Aryanic HighMail (High CMS) - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-23517 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMAryanic HighMail (High CMS) - Cross-Site ScriptingCVSS 6.1

A cross-site scripting vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.

WeaknessesCWE-79
Authorsgeeknik
Template tagscvecve2020xsscmshighmailaryanicvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:aryanic:high_cms:*:*:*:*:*:*:*:*
Shodan: title:"HighMail"
Shodan: http.title:"highmail"
FOFA: title="HighMail"
FOFA: title="highmail"
Google: intitle:"highmail"
https://vulnerabilitypublishing.blogspot.com/2021/03/aryanic-highmail-high-cms-reflected.html https://nvd.nist.gov/vuln/detail/CVE-2020-23517 https://github.com/ARPSyndicate/kenzer-templates https://github.com/Elsfa7-110/kenzer-templates https://github.com/d4n-sec/d4n-sec.github.io

Source: ProjectDiscovery

References

2