CVE-2020-6171

MEDIUMNuclei

CLink Office 2.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-6171 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A cross-site scripting (XSS) vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMCLink Office 2.0 - Cross-Site ScriptingCVSS 6.1

CLink Office 2.0 is vulnerable to cross-site scripting in the index page of the management console and allows remote attackers to inject arbitrary web script or HTML via the lang parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Apply the latest security patches or updates provided by the vendor to fix this vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2020xssclink-officecommunilinkvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:communilink:clink_office:2.0:*:*:*:*:*:*:*
https://www.deepcode.ca/index.php/2020/04/07/cve-2020-xss-in-clink-office-v2/ https://nvd.nist.gov/vuln/detail/CVE-2020-6171 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2