PT-2020-20464
CVE-2020-9056
·
Published
2020-04-10
·
Updated
2020-04-13
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Periscope BuySpeed versions 14.5 through 15.2
Description
The issue allows a local, authenticated attacker to store arbitrary JavaScript within the application, which is then executed in the user's browser without sanitization. This could lead to website redirection, session hijacking, or information disclosure.
Recommendations
For Periscope BuySpeed versions 14.5 through 15.2, update to version 15.3 to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾