CVE-2020-29144
Last modified
CVE-2020-29144 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admins' browsers by using the beef framework.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ericsson | Bscs Ix R18 Billing \& Rating Admx | All versions |
| Ericsson | Bscs Ix R18 Billing \& Rating Mx | All versions |
References
- http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.htmlExploit, Third Party Advisory
- http://the-it-wonders.blogspot.com/2020/01/ericsson-bscs-ix-r18-billing-rating.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-29144?
How severe is CVE-2020-29144?
How do I fix CVE-2020-29144?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-29138Incorrect Access Control in the configuration backup path in…5.3
- CVE-2020-29139A SQL injection vulnerability in interface/main/finder/patie…7.2
- CVE-2020-2914Vulnerability in the Oracle VM VirtualBox product of Oracle …7
- CVE-2020-29140A SQL injection vulnerability in interface/reports/immunizat…7.2
- CVE-2020-29142A SQL injection vulnerability in interface/usergroup/usergro…7.2
- CVE-2020-29143A SQL injection vulnerability in interface/reports/non_repor…7.2
- CVE-2020-29145In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a w…5.4
- CVE-2020-29146A cross site scripting (XSS) vulnerability in index.php of W…6.1
- CVE-2020-29147A SQL injection vulnerability in wy_controlls/wy_side_visito…7.5
- CVE-2020-2915Vulnerability in the Oracle Coherence product of Oracle Fusi…9.8
- CVE-2020-29156The WooCommerce plugin before 4.7.0 for WordPress allows rem…5.3
- CVE-2020-29157An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers t…7.8
Are you affected by CVE-2020-29144?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST