CVE Vulnerability

CVE-2020-25071

** DISPUTED ** Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped."

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://medium.com/@muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7 Exploit Third Party Advisory
https://niftypm.com/security Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:niftypm:nifty:2020-08-26:*:*:*:*:*:*:*
Information

Published : 2020-09-15 06:15

Updated : 2022-01-01 06:38

NVD link : CVE-2020-25071

Mitre link : CVE-2020-25071

Products Affected
No products.
CWE
CWE-79