CVE-2020-24912: XSS
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/qcubed/qcubedto a version that resolves this vulnerability.Fixed in 3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2020-24912?
CVE-2020-24912 is classified as a reflected cross-site scripting (XSS) vulnerability, allowing unauthenticated attackers to compromise user sessions.
How do I fix CVE-2020-24912?
To mitigate CVE-2020-24912, upgrade Qcubed to version 3.2 or later.
Who is affected by CVE-2020-24912?
CVE-2020-24912 affects all versions of Qcubed up to 3.1.1.
What can attackers achieve with CVE-2020-24912?
Attackers can use CVE-2020-24912 to steal sessions of authenticated users through malicious manipulation of the stQuery parameter.
Is user authentication required to exploit CVE-2020-24912?
No, CVE-2020-24912 can be exploited by unauthenticated attackers.