PT-2020-15946
CVE-2020-25104
·
Published
2020-09-03
·
Updated
2020-09-10
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
eramba versions c2.8.1 through e2.19.2
eramba Enterprise versions prior to e2.19.3
Description
The issue allows for cross-site scripting (XSS) attacks via a crafted filename for a file attached to an object. This can be achieved by including a complete XSS payload followed by a file extension, such as .png, in the filename.
Recommendations
For eramba versions c2.8.1 through e2.19.2, update to version e2.19.3 or later.
For eramba Enterprise versions prior to e2.19.3, update to version e2.19.3 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾