CVE-2020-29070: XSS

Published Nov 25, 2020

Updated

osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.

Affected Software

1 affected component

osCommerce oscommerce=2.3.4.1

Remediation

Patch Available

https://github.com/gburton/CE-Phoenix/commits/master

Event History

Nov 25, 2020

CVE Published

via MITRE·07:05 PM

Data Sourced

via MITRE·07:05 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-29070?

The severity of CVE-2020-29070 is medium.

What is the affected software for CVE-2020-29070?

The affected software for CVE-2020-29070 is osCommerce 2.3.4.1.

How does CVE-2020-29070 exploit happen?

CVE-2020-29070 exploits osCommerce 2.3.4.1 by allowing an authenticated user to enter an XSS payload into the title section of newsletters.

How can I mitigate CVE-2020-29070?

To mitigate CVE-2020-29070, it is recommended to update osCommerce to a version that addresses the XSS vulnerability.

Where can I find more information about CVE-2020-29070?

You can find more information about CVE-2020-29070 in the following references: [link1](https://forums.oscommerce.com/forum/17-news-and-announcements/), [link2](https://github.com/aslanemre/cve-2020-29070/blob/main/CVE-2020-29070), [link3](https://github.com/gburton/CE-Phoenix/commits/master).