CVE-2020-23376: XSS

Published May 10, 2021

Updated

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.

Affected Software

1 affected component

5none Nonecms=1.3.0

Event History

May 10, 2021

CVE Published

via MITRE·10:12 PM

Data Sourced

via MITRE·10:12 PM

Description

Frequently Asked Questions

What is the vulnerability ID for NoneCMS v1.3?

The vulnerability ID for NoneCMS v1.3 is CVE-2020-23376.

What is the severity of CVE-2020-23376?

The severity of CVE-2020-23376 is medium with a CVSS score of 6.1.

Which software versions are affected by CVE-2020-23376?

CVE-2020-23376 affects NoneCMS v1.3.0.

How does CVE-2020-23376 work?

CVE-2020-23376 is a CSRF vulnerability in NoneCMS v1.3 that allows an attacker to add a navigation column with arbitrary web script or HTML via the name parameter, leading to a stored XSS attack.

Are there any references related to CVE-2020-23376?

Yes, you can find more information about CVE-2020-23376 at the following references: [link1](https://cwe.mitre.org/data/definitions/352.html), [link2](https://github.com/nangge/noneCms/issues/35).