CVE-2020-24912

MEDIUMNuclei

qcubed reflected cross-site scripting (XSS) vulnerability

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2020-24912 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

qcubed/qcubed

Browse Packagist / qcubed/qcubed
GitHub AdvisoryBefore 3.2 · Fixed in 3.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMQCube Cross-Site-ScriptingCVSS 6.1

A reflected cross-site scripting vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscve2020cveqcubedxssseclistsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:qcubed:qcubed:*:*:*:*:*:*:*:*
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 https://github.com/qcubed/qcubed/pull/1320/files https://nvd.nist.gov/vuln/detail/CVE-2020-24912 http://seclists.org/fulldisclosure/2021/Mar/30 http://qcubed.com/

Source: ProjectDiscovery

References

8