CVE-2020-14988

An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://tvrbk.github.io/cve/2021/03/09/brXM.html	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bloomreach:experience_manager:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-11 19:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-14988

Mitre link : CVE-2020-14988

CVE.ORG link : CVE-2020-14988

JSON object : View

Products Affected

bloomreach

experience_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2020-14988", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2021-03-11T19:15:12.717", "references": [{"url": "https://tvrbk.github.io/cve/2021/03/09/brXM.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Bloomreach Experience Manager (brXM) versiones 4.1.0 hasta 14.2.2. Permite un ataque de tipo XSS en la p\u00e1gina de inicio de sesi\u00f3n por medio del par\u00e1metro loginmessage, el editor de texto por medio del atributo src de los elementos HTML, el men\u00fa de traducciones por medio del par\u00e1metro foldername, la p\u00e1gina de autor por medio de la URL del enlace o la funcionalidad de carga de imagen por medio de un documento SVG que contiene JavaScript"}], "lastModified": "2021-03-16T17:15:48.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bloomreach:experience_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A89A8A50-DA47-49F7-8317-CB0B197C1F48", "versionEndIncluding": "14.2.2", "versionStartIncluding": "14.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}