CVE-2020-29477

Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
References
Link Resource
http://invision.com Not Applicable
https://www.exploit-db.com/exploits/49188 Exploit Third Party Advisory VDB Entry
http://invision.com Not Applicable
https://www.exploit-db.com/exploits/49188 Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:invisioncommunity:community:4.5.4:*:*:*:*:*:*:*

History

21 Nov 2024, 05:24

Type Values Removed Values Added
References () http://invision.com - Not Applicable () http://invision.com - Not Applicable
References () https://www.exploit-db.com/exploits/49188 - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/49188 - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2020-12-30 15:15

Updated : 2024-11-21 05:24


NVD link : CVE-2020-29477

Mitre link : CVE-2020-29477

CVE.ORG link : CVE-2020-29477


JSON object : View

Products Affected

invisioncommunity

  • community
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')