CVE Vulnerability

CVE-2020-26505

A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.marmind.com/en/ Vendor Advisory
https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:marmind:marmind:4.1.141.0:*:*:*:*:*:*:*
Information

Published : 2020-11-05 05:15

Updated : 2020-11-09 04:11

NVD link : CVE-2020-26505

Mitre link : CVE-2020-26505

Products Affected
No products.
CWE
CWE-79