CVE-2020-13248

Name of the Vulnerable Software and Affected Versions BooleBox Secure File Sharing Utility versions prior to 4.2.3.0

Description The issue allows for stored XSS via a crafted avatar field within My Account JSON data to the "Account.aspx" endpoint. This can be exploited by manipulating the avatar field in the JSON data.

Recommendations For versions prior to 4.2.3.0, update to version 4.2.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Account.aspx" endpoint or disabling the ability to upload custom avatars until the update is applied. Avoid using the avatar field in the My Account JSON data until the issue is resolved.