CVE-2020-4775
Last modified
CVE-2020-4775 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Curam Social Program Management | 7.0.9.0 |
| Ibm | Curam Social Program Management | 7.0.10.0 |
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189153VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6346571Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189153VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6346571Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-4775?
How severe is CVE-2020-4775?
How do I fix CVE-2020-4775?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-4767IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, …7.5
- CVE-2020-4768IBM Case Manager 5.2 and 5.3 and IBM Business Automation Wor…5.4
- CVE-2020-4771IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1…5.3
- CVE-2020-4772An XML External Entity Injection (XXE) vulnerability may imp…8.1
- CVE-2020-4773A cross-site request forgery (CSRF) vulnerability may impact…6.5
- CVE-2020-4774An XPath vulnerability may impact IBM Curam Social Program M…5.4
- CVE-2020-4776A path traversal vulnerability may impact IBM Curam Social P…7.5
- CVE-2020-4778IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD…7.5
- CVE-2020-4779A HTTP Verb Tampering vulnerability may impact IBM Curam Soc…8.1
- CVE-2020-4780OOTB build scripts does not set the secure attribute on sess…5.3
- CVE-2020-4781An improper input validation before calling java readLine() …6.5
- CVE-2020-4782IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 coul…6.5
Are you affected by CVE-2020-4775?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST