CVE-2020-13972

Name of the Vulnerable Software and Affected Versions Enghouse Web Chat version 6.2.284.34

Description The issue allows for cross-site scripting (XSS) when a user enters their own domain name in the WebServiceLocation parameter. The response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser.

Recommendations For Enghouse Web Chat version 6.2.284.34, consider restricting access to the WebServiceLocation parameter to prevent external JavaScript execution until a fix is available. Avoid using the WebServiceLocation parameter with external domain names to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.