CVE-2020-19611: XSS

Published Dec 7, 2021

Updated

Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter.

Affected Software

1 affected component

Racktables Project Racktables=0.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Racktables to a version that resolves this vulnerability.
Fixed in 0.21.2
Configuration
Update the redirect module to properly validate and escape the 'op' parameter so injected HTML/script cannot be rendered (XSS via op parameter).
R acktables redirect module op parameter handling = Sanitize/escape user-supplied input to prevent injection of arbitrary web script/HTML

Event History

Dec 7, 2021

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-19611?

CVE-2020-19611 is classified as a medium severity vulnerability due to its potential to allow XSS attacks.

How do I fix CVE-2020-19611?

To fix CVE-2020-19611, upgrade Racktables to a version higher than 0.21.2 where the vulnerability has been addressed.

What software is affected by CVE-2020-19611?

CVE-2020-19611 affects Racktables version 0.21.2.

What type of vulnerability is CVE-2020-19611?

CVE-2020-19611 is a Cross Site Scripting (XSS) vulnerability.

How can CVE-2020-19611 be exploited?

CVE-2020-19611 can be exploited by injecting arbitrary web scripts or HTML through the op parameter in the redirect module.