CVE-2020-25352: XSS
Published Aug 20, 2021
·Updated
A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving.
Affected Software
1 affected component
rConfig rConfig=3.9.5
Event History
Aug 20, 2021
CVE Published
via MITRE·06:10 PM
Data Sourced
via MITRE·06:10 PM
Description
Frequently Asked Questions
1
What is CVE-2020-25352?
CVE-2020-25352 is a stored cross-site scripting (XSS) vulnerability in the /devices.php function in rConfig 3.9.5.
2
How severe is CVE-2020-25352?
CVE-2020-25352 has a severity score of 5.4, which is categorized as medium.
3
How does CVE-2020-25352 affect rConfig?
CVE-2020-25352 allows remote attackers to perform arbitrary JavaScript execution through entering a crafted payload into the 'Model' field in rConfig 3.9.5.
4
Has CVE-2020-25352 been fixed?
Yes, CVE-2020-25352 has been fixed in rConfig version 3.9.6.
5
What is the CWE ID for CVE-2020-25352?
The CWE ID for CVE-2020-25352 is CWE-79.