PT-2020-10265

CVE-2019-19858

Published

2020-01-15

Updated

2020-01-17

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Serpico version 1.3.0

Description An issue was discovered in Serpico, allowing stored XSS via the author parameter in the "admin/add user/UID" endpoint.

Recommendations For Serpico version 1.3.0, avoid using the author parameter in the "admin/add user/UID" endpoint until the issue is resolved.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾