PT-2020-20440

CVE-2020-9025

·

Published

2020-02-17

·

Updated

2020-02-19

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit version 2.4.2
Description The issue concerns multiple stored XSS problems in all parameters of the Start Data Viewer feature, specifically within the /cgi-bin/loaddata.py script.
Recommendations For Iteris Vantage Velocity Field Unit version 2.4.2, consider disabling access to the /cgi-bin/loaddata.py script until a fix is available, and restrict the use of the Start Data Viewer feature to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2020-9025
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com