CVE-2020-28364: XSS

Q: Who is realistically exposed to this issue?

Installations that expose the Locust Web UI to outside users are affected. The description notes that this exposure violates the intended usage expectations for the UI.

Q: What must an attacker be able to do to exploit it?

An attacker needs access to interact with the exposed Web UI and must cause a victim to view the stored malicious content. The CVSS vector indicates no privileges are required, but user interaction is required.

Q: Is the default intended deployment affected?

The issue is described as affecting deployments that expose the Web UI to outside users, which is contrary to the stated usage expectations. The provided data does not indicate that a UI kept inaccessible to outside users is exposed.

Q: What can be done if updating is not immediately possible?

Restrict the Locust Web UI so that outside users cannot access it. This directly addresses the exposure condition identified in the vulnerability description.

Published Nov 9, 2020

Updated

A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.

Affected Software

2 affected componentsFixes available

pip/locust<1.3.2

1.3.2

Locust Locust<1.3.2

Event History

Nov 9, 2020

CVE Published

via MITRE·07:19 PM

Data Sourced

via MITRE·07:19 PM

Description

May 24, 2022

Advisory Published

via GitHub·05:34 PM

Frequently Asked Questions

Who is realistically exposed to this issue?

Installations that expose the Locust Web UI to outside users are affected. The description notes that this exposure violates the intended usage expectations for the UI.

What must an attacker be able to do to exploit it?

An attacker needs access to interact with the exposed Web UI and must cause a victim to view the stored malicious content. The CVSS vector indicates no privileges are required, but user interaction is required.

Is the default intended deployment affected?

The issue is described as affecting deployments that expose the Web UI to outside users, which is contrary to the stated usage expectations. The provided data does not indicate that a UI kept inaccessible to outside users is exposed.

What can be done if updating is not immediately possible?

Restrict the Locust Web UI so that outside users cannot access it. This directly addresses the exposure condition identified in the vulnerability description.

CVE-2020-28364: XSS

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker be able to do to exploit it?

Is the default intended deployment affected?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker be able to do to exploit it?

Is the default intended deployment affected?

What can be done if updating is not immediately possible?