A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.
References
Link | Resource |
---|---|
https://www.marmind.com/en/ | Vendor Advisory |
https://www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html?nc=1 | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-11-05T16:57:01
Updated: 2020-11-05T16:57:01
Reserved: 2020-10-01T00:00:00
Link: CVE-2020-26505
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-11-05T17:15:12.443
Modified: 2020-11-09T04:11:36.887
Link: CVE-2020-26505
JSON object: View
Redhat Information
No data.
CWE