CVE-2020-28141

The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.60% chance of exploitation in the next 30 days, 47th percentile

Published

2021-04-19

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48897

References

• CVE Record
• NVD entry

Related

• CVE-2020-28140
• CVE-2020-28145
• CVE-2020-28139
• CVE-2020-28146
• CVE-2020-28138
• CVE-2020-28149