CVE-2020-23452: XSS
Published Jul 5, 2023
·Updated
A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
Affected Software
1 affected component
Selenium Selenium Grid=3.141.59
Event History
Jul 5, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this cross-site scripting (XSS) vulnerability?
The vulnerability ID of this cross-site scripting (XSS) vulnerability is CVE-2020-23452.
2
What is the affected software?
The affected software is Selenium Grid version 3.141.59.
3
How can attackers exploit this vulnerability?
Attackers can exploit this vulnerability by injecting a crafted payload into the hub parameter under the /grid/console page in Selenium Grid.
4
What is the severity of this vulnerability?
The severity of this vulnerability is medium with a CVSS score of 6.1.
5
How can I fix this cross-site scripting (XSS) vulnerability in Selenium Grid?
To fix this vulnerability, update to a version of Selenium Grid that is not affected by the XSS vulnerability and follow best practices for secure web application development.