CVE-2020-23209: XSS

Published Jul 1, 2021

Updated

A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.

Affected Software

1 affected component

PHPlist PHPList=3.5.3

Event History

Jul 1, 2021

CVE Published

via MITRE·08:12 PM

Data Sourced

via MITRE·08:12 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-23209?

CVE-2020-23209 has a medium severity rating due to its potential to allow attackers to execute arbitrary scripts in the context of affected applications.

How do I fix CVE-2020-23209?

To fix CVE-2020-23209, upgrade to a patched version of phpList that addresses this stored XSS vulnerability.

What versions of phpList are affected by CVE-2020-23209?

CVE-2020-23209 affects phpList version 3.5.3 specifically.

What type of vulnerability is CVE-2020-23209?

CVE-2020-23209 is classified as a stored cross site scripting (XSS) vulnerability.

How can attackers exploit CVE-2020-23209?

Attackers can exploit CVE-2020-23209 by injecting a crafted payload into the 'List Description' field, which gets executed in users' browsers.