CVE-2020-23208: XSS

Published Jul 1, 2021

Updated

A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.

Affected Software

1 affected component

PHPlist PHPList=3.5.3

Remediation

Patch Available

https://github.com/phpList/phplist3/issues/665

Event History

Jul 1, 2021

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

Description

Frequently Asked Questions

What is the vulnerability identifier for the stored cross site scripting (XSS) vulnerability in phplist 3.5.3?

The vulnerability identifier for the stored cross site scripting (XSS) vulnerability in phplist 3.5.3 is CVE-2020-23208.

What is the severity of CVE-2020-23208?

The severity of CVE-2020-23208 is medium with a CVSS score of 5.4.

How does the stored cross site scripting (XSS) vulnerability in phplist 3.5.3 occur?

The stored cross site scripting (XSS) vulnerability in phplist 3.5.3 occurs when attackers enter a crafted payload into the "Send test" field under the "Start or continue campaign" module.

What can attackers do with the stored cross site scripting (XSS) vulnerability in phplist 3.5.3?

Attackers can execute arbitrary web scripts or HTML with the stored cross site scripting (XSS) vulnerability in phplist 3.5.3.

How can I mitigate the stored cross site scripting (XSS) vulnerability in phplist 3.5.3?

To mitigate the stored cross site scripting (XSS) vulnerability in phplist 3.5.3, update to a version that has the vulnerability fixed or apply the available patch.