Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs.
References
Link | Resource |
---|---|
https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities | Vendor Advisory |
https://community.safe.com/s/article/fme-server-2019-security-update | Vendor Advisory |
https://mexicanpentester.com/2020/04/09/vulnerabilities-in-fme-server-versions-2019-2-and-2020-0-beta-and-probably-previous-versions/ | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-04-28T20:42:54
Updated: 2021-06-16T10:45:42
Reserved: 2020-08-13T00:00:00
Link: CVE-2020-22790
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-04-28T21:15:08.770
Modified: 2021-06-17T16:58:54.353
Link: CVE-2020-22790
JSON object: View
Redhat Information
No data.
CWE