CVE-2020-21088 - OpenCVE

Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
X2engine	X2crm

Configuration 1 [-]

cpe:2.3:a:x2engine:x2crm:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/X2Engine/X2CRM/issues/161	Exploit Third Party Advisory
https://github.com/X2Engine/X2CRM/issues/183	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2021-04-14T13:49:44

Updated: 2021-04-14T13:49:44

Reserved: 2020-08-13T00:00:00

Link: CVE-2020-21088

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-04-14T14:15:13.210

Modified: 2021-04-21T01:49:28.660

Link: CVE-2020-21088

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:x2engine:x2crm:*:*:*:*:*:*:*:*", "matchCriteriaId": "E857D0EB-324B-4501-9AA1-966454FEFF3A", "versionEndIncluding": "7.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the \"First Name\" and \"Last Name\" fields in \"/index.php/contacts/create page\""}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en X2engine X2CRM versiones v7.1 y anteriores, permite a atacantes remotos obtener informaci\u00f3n confidencial al inyectar un script web o HTML arbitrario por medio de los campos \"First Name\" y \"Last Name\" en \"/index.php/contacts/create page\""}], "id": "CVE-2020-21088", "lastModified": "2021-04-21T01:49:28.660", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-14T14:15:13.210", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/X2Engine/X2CRM/issues/161"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/X2Engine/X2CRM/issues/183"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}