ID |
CVE-2020-23370
|
Sažetak |
In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. |
Reference |
|
CVSS |
Base: | 3.5 |
Impact: | 2.9 |
Exploitability: | 6.8 |
|
Pristup |
Vektor | Složenost | Autentikacija |
NETWORK |
MEDIUM |
SINGLE |
|
Impact |
Povjerljivost | Cjelovitost | Dostupnost |
NONE |
PARTIAL |
NONE |
|
CVSS vektor |
AV:N/AC:M/Au:S/C:N/I:P/A:N |
Zadnje važnije ažuriranje |
13-05-2021 - 20:32 |
Objavljeno |
10-05-2021 - 23:15 |