CVE-2020-8496

Name of the Vulnerable Software and Affected Versions Kronos Web Time and Attendance (webTA) versions 4.1.x through 4.x before 5.0

Description The issue concerns a Stored XSS vulnerability. It can be triggered by setting the Application Banner input field of the "/ApplicationBanner" page as an authenticated administrator.

Recommendations For versions 4.1.x through 4.x before 5.0, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ApplicationBanner" page for authenticated administrators until a patch is available. Avoid using the Application Banner input field in the affected page until the issue is resolved.