CVE-2020-36634 — Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting

Back Back to CVE browser

MEDIUM

Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting

Published Dec 27, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.50%

Description

A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability.

Affected products

Vendor Indeed Engineering Product Util Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  -
- Version
  1.0.1
  Status
  affected
  Constraints
  -
- Version
  1.0.10
  Status
  affected
  Constraints
  -
- Version
  1.0.11
  Status
  affected
  Constraints
  -
- Version
  1.0.12
  Status
  affected
  Constraints
  -
- Version
  1.0.13
  Status
  affected
  Constraints
  -
- Version
  1.0.14
  Status
  affected
  Constraints
  -
- Version
  1.0.15
  Status
  affected
  Constraints
  -
- Version
  1.0.16
  Status
  affected
  Constraints
  -
- Version
  1.0.17
  Status
  affected
  Constraints
  -
- Version
  1.0.18
  Status
  affected
  Constraints
  -
- Version
  1.0.19
  Status
  affected
  Constraints
  -
- Version
  1.0.2
  Status
  affected
  Constraints
  -
- Version
  1.0.20
  Status
  affected
  Constraints
  -
- Version
  1.0.21
  Status
  affected
  Constraints
  -
- Version
  1.0.22
  Status
  affected
  Constraints
  -
- Version
  1.0.23
  Status
  affected
  Constraints
  -
- Version
  1.0.24
  Status
  affected
  Constraints
  -
- Version
  1.0.25
  Status
  affected
  Constraints
  -
- Version
  1.0.26
  Status
  affected
  Constraints
  -
- Version
  1.0.27
  Status
  affected
  Constraints
  -
- Version
  1.0.28
  Status
  affected
  Constraints
  -
- Version
  1.0.29
  Status
  affected
  Constraints
  -
- Version
  1.0.3
  Status
  affected
  Constraints
  -
- Version
  1.0.30
  Status
  affected
  Constraints
  -
- Version
  1.0.31
  Status
  affected
  Constraints
  -
- Version
  1.0.32
  Status
  affected
  Constraints
  -
- Version
  1.0.33
  Status
  affected
  Constraints
  -
- Version
  1.0.4
  Status
  affected
  Constraints
  -
- Version
  1.0.5
  Status
  affected
  Constraints
  -
- Version
  1.0.6
  Status
  affected
  Constraints
  -
- Version
  1.0.7
  Status
  affected
  Constraints
  -
- Version
  1.0.8
  Status
  affected
  Constraints
  -
- Version
  1.0.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Indeed Engineering

Util

n/a

Version	Status	Constraints
1.0.0	affected	-
1.0.1	affected	-
1.0.10	affected	-
1.0.11	affected	-
1.0.12	affected	-
1.0.13	affected	-
1.0.14	affected	-
1.0.15	affected	-
1.0.16	affected	-
1.0.17	affected	-
1.0.18	affected	-
1.0.19	affected	-
1.0.2	affected	-
1.0.20	affected	-
1.0.21	affected	-
1.0.22	affected	-
1.0.23	affected	-
1.0.24	affected	-
1.0.25	affected	-
1.0.26	affected	-
1.0.27	affected	-
1.0.28	affected	-
1.0.29	affected	-
1.0.3	affected	-
1.0.30	affected	-
1.0.31	affected	-
1.0.32	affected	-
1.0.33	affected	-
1.0.4	affected	-
1.0.5	affected	-
1.0.6	affected	-
1.0.7	affected	-
1.0.8	affected	-
1.0.9	affected	-

Remediation

No remediation recorded yet.

Metrics

0.50% 0.00503

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00503

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.50% (0.00503)	40.88th	v5 (v2026.06.15)
Jun 15, 2026	0.50% (0.00503)	38.80th	v5 (v2026.06.15)
Mar 17, 2025	0.06% (0.00063)	16.81th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00073)	33.71th	v3 (v2023.03.01)
Jan 3, 2024	0.07% (0.00075)	31.01th	v3 (v2023.03.01)
Nov 27, 2023	0.06% (0.00060)	23.99th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.58th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Dec 28, 2022	0.95% (0.00950)	31.62th	v2 (v2022.01.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63
patchThird Party Advisory
https://github.com/indeedeng/util/releases/tag/published%2F1.0.34
patchRelease NotesThird Party Advisory
https://vuldb.com/?ctiid.216882
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216882
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63		patchThird Party Advisory
https://github.com/indeedeng/util/releases/tag/published%2F1.0.34		patchRelease NotesThird Party Advisory
https://vuldb.com/?ctiid.216882		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.216882		vdb-entrytechnical-descriptionThird Party Advisory