CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

13.11% chance of exploitation in the next 30 days, 96th percentile

Nuclei

high

Published

2020-10-16

Updated

2024-08-04

Proof-of-concept exploits (1)

• Security-AVS/CVE-2020-162700★ · 2020-10-15

Nuclei templates (1)

• linuxadi/40k-nuclei-templates/blob/main/aditya/folder4/cve-2020-16270-4637.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2019-13633
• CVE-2021-26903
• CVE-2021-26904
• CVE-2021-29267
• CVE-2021-30146
• CVE-2020-16269