CVE-2020-12256: XSS
Published May 18, 2020
·Updated
rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.
Affected Software
1 affected component
rConfig rConfig=3.9.4
Event History
May 18, 2020
CVE Published
via MITRE·02:03 PM
Data Sourced
via MITRE·02:03 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this rConfig vulnerability?
The vulnerability ID for this rConfig vulnerability is CVE-2020-12256.
2
What is the severity level of CVE-2020-12256?
CVE-2020-12256 has a severity level of medium.
3
How does this vulnerability affect rConfig?
This vulnerability affects rConfig version 3.9.4.
4
What is the CWE ID associated with CVE-2020-12256?
The CWE ID associated with CVE-2020-12256 is CWE-79.
5
How can an attacker exploit CVE-2020-12256?
An attacker can exploit CVE-2020-12256 by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.