CVE-2019-20802

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim's device. However, a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.70% chance of exploitation in the next 30 days, 51th percentile

Published

2020-05-17

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://logicaltrust.net/blog/2019/12/documents.html#xss

References

• CVE Record
• NVD entry

Related

• CVE-2019-20801
• CVE-2019-20803
• CVE-2019-20800
• CVE-2019-20804
• CVE-2019-20799
• CVE-2019-20908