CVE-2020-28955: XSS

Published Oct 22, 2021

Updated

SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.

Affected Software

1 affected component

SugarCRM SugarCRM=6.5.18

Event History

Oct 22, 2021

CVE Published

via MITRE·07:20 PM

Data Sourced

via MITRE·07:20 PM

Description

Frequently Asked Questions

What is CVE-2020-28955?

CVE-2020-28955 is a cross-site scripting (XSS) vulnerability in the Create Employee module of SugarCRM v6.5.18.

What is the severity of CVE-2020-28955?

CVE-2020-28955 has a severity rating of 5.4 (medium).

How does CVE-2020-28955 work?

CVE-2020-28955 allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload in the First Name or Last Name input fields.

How can I fix CVE-2020-28955?

To fix CVE-2020-28955, it is recommended to update to a version of SugarCRM that is not affected by this vulnerability.

Where can I find more information about CVE-2020-28955?

You can find more information about CVE-2020-28955 at the following reference: https://www.vulnerability-lab.com/get_content.php?id=2257