CVE-2020-14018 Information

Description

An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page the XSS is only triggered via the E-Mail field; however on the View user page the XSS is triggered via either the User field or the E-Mail field.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://blog.sean-wright.com/navigate-cms/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1