CVE-2020-13639
Last modified
CVE-2020-13639 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Outsystems | Lifetime Management Console | >= 11, < 11.7.0 |
| Outsystems | Outsystems | >= 10, < 10.0.1005.2 |
| Outsystems | Platform Server | >= 11, < 11.9.0 |
References
- https://labs.integrity.pt/advisories/CVE-2020-13639/Third Party Advisory
- https://labs.integrity.pt/advisories/CVE-2020-13639/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-13639?
How severe is CVE-2020-13639?
How do I fix CVE-2020-13639?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-13631SQLite before 3.32.0 allows a virtual table to be renamed to…5.5
- CVE-2020-13632ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL p…5.5
- CVE-2020-13633Fork before 5.8.3 allows XSS via navigation_title or title.6.1
- CVE-2020-13634In Windows Master (aka Windows Optimization Master) 7.99.13.…7.8
- CVE-2020-13637An issue was discovered in the stashcat app through 3.9.2 fo…7.5
- CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has a…9.8
- CVE-2020-1364A denial of service vulnerability exists in the way that the…7.1
- CVE-2020-13640A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 …9.8
- CVE-2020-13641An issue was discovered in the Real-Time Find and Replace pl…8.8
- CVE-2020-13642An issue was discovered in the SiteOrigin Page Builder plugi…8.8
- CVE-2020-13643An issue was discovered in the SiteOrigin Page Builder plugi…8.8
- CVE-2020-13644An issue was discovered in the Accordion plugin before 2.2.9…5.4
Are you affected by CVE-2020-13639?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST