CVE-2020-36396 - A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter

Back Back to CVE browser

MEDIUM

A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter

Published Jul 2, 2021

5.4

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3966
Advisory
https://github.com/LavaLite/cms/issues/322
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-gjf5-j475-p4g6
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36396

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3966		Advisory
https://github.com/LavaLite/cms/issues/322		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-gjf5-j475-p4g6		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36396