CVE-2020-13409

Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3)

• CWE-79

• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.mdThird Party Advisory
• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.mdThird Party Advisory

Published

Feb 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1340A spoofing vulnerability exists when the NuGetGallery does n…5.4
• CVE-2020-13401An issue was discovered in Docker Engine before 19.03.11. An…6
• CVE-2020-13404The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3…8.8
• CVE-2020-13405userfiles/modules/users/controller/controller.php in Microwe…7.5
• CVE-2020-13407Tufin SecureTrack < R20-2 GA contains reflected + stored XSS…5.9
• CVE-2020-13408Tufin SecureTrack < R20-2 GA contains reflected + stored XSS…5.9
• CVE-2020-13410An issue was discovered in MoscaJS Aedes 0.42.0. lib/write.j…7.5
• CVE-2020-13412An issue was discovered in Aviatrix Controller before 5.4.12…8.8
• CVE-2020-13413An issue was discovered in Aviatrix Controller before 5.4.12…5.3
• CVE-2020-13414An issue was discovered in Aviatrix Controller before 5.4.12…7.5
• CVE-2020-13415An issue was discovered in Aviatrix Controller through 5.1. …7.5
• CVE-2020-13416An issue was discovered in Aviatrix Controller before 5.4.10…6.5