CVE-2020-24901 - The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url

Back Back to CVE browser

MEDIUM

The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url

Published Jan 7, 2021

6.1

MEDIUM

CVSS 3.1

EPSS 4.12%

Description

The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugin[test].url.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17609
Advisory
https://packetstormsecurity.com/files/159477/Krpano-Panorama-Viewer-1.20.8-Cross-Site-Scripting.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-17609		Advisory
https://packetstormsecurity.com/files/159477/Krpano-Panorama-Viewer-1.20.8-Cross-Site-Scripting.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry