PT-2022-8713

CVE-2020-25491

·

Published

2022-09-16

·

Updated

2022-09-21

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions 6Kare Emakin version 5.0.341.0
Description The issue is related to Cross Site Scripting (XSS) via the "/rpc/membership/setProfile" endpoint, specifically the DisplayName field, which is mishandled when rendering the Activity Stream page.
Recommendations For version 5.0.341.0, consider disabling the rendering of the DisplayName field in the Activity Stream page until a patch is available. Restrict access to the "/rpc/membership/setProfile" endpoint to minimize the risk of exploitation. Avoid using the DisplayName field in this endpoint until the issue is resolved.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2020-25491
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com