CVE-2020-36397 - A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter

Back Back to CVE browser

MEDIUM

A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter

Published Jul 2, 2021

5.4

MEDIUM

CVSS 3.1

EPSS 0.51%

Description

A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/LavaLite/cms/issues/323
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-3cfg-rxh6-h2rh
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36397

Link	Providers	Tags
https://github.com/LavaLite/cms/issues/323		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-3cfg-rxh6-h2rh		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-36397