CVE-2020-12438: XSS

Published Apr 28, 2020

Updated

An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.

Affected Software

1 affected component

PHP-Fusion php-fusion=9.03.50

Remediation

Patch Available

https://github.com/php-fusion/PHP-Fusion/commit/c36006f900d855f1173f81cea1a774295049f4d8

Event History

Apr 28, 2020

CVE Published

via MITRE·08:51 PM

Data Sourced

via MITRE·08:51 PM

Description

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2020-12438.

What is the severity of CVE-2020-12438?

The severity of CVE-2020-12438 is medium with a CVSS score of 5.4.

What is the affected software?

The affected software is PHP-Fusion version 9.03.50.

How does the vulnerability in banners.php page of PHP-Fusion 9.03.50 work?

The vulnerability allows for cross-site scripting (XSS) attacks by exploiting the lack of proper XSS security measures in the banners.php page.

How can the XSS vulnerability in PHP-Fusion 9.03.50 be exploited?

The XSS vulnerability in PHP-Fusion 9.03.50 can be exploited by using HTML event handlers to execute malicious JavaScript code.

Is there a fix for CVE-2020-12438?

Yes, a fix for CVE-2020-12438 is available. Please refer to the provided references for more information on how to fix this vulnerability.