CVE-2020-23190: XSS

Published Jul 2, 2021

Updated

A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

Affected Software

1 affected component

PHPlist PHPList=3.5.4

Remediation

Patch Available

https://github.com/phpList/phplist3/issues/667

Event History

Jul 2, 2021

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-23190?

CVE-2020-23190 is classified as a stored cross site scripting (XSS) vulnerability, which can allow authenticated attackers to execute arbitrary web scripts.

How do I fix CVE-2020-23190?

To fix CVE-2020-23190, upgrade to the latest version of phpList that has mitigated this vulnerability.

Who is affected by CVE-2020-23190?

The vulnerability affects users of phpList version 3.5.4 who have access to the "Import emails" module.

What types of attacks can CVE-2020-23190 facilitate?

CVE-2020-23190 can facilitate attacks that lead to the execution of arbitrary web scripts or HTML on behalf of the user.

Is it easy to exploit CVE-2020-23190?

Exploitation of CVE-2020-23190 requires authentication, but if successful, it can lead to significant security risks.