CVE-2020-29475: XSS

Published Dec 29, 2020

Updated

nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Affected Software

1 affected component

Nopcommerce Store=4.30

Event History

Dec 29, 2020

CVE Published

via MITRE·02:47 PM

Data Sourced

via MITRE·02:47 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-29475?

CVE-2020-29475 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2020-29475?

To fix CVE-2020-29475, update nopCommerce to the latest version as the vulnerability has been addressed in newer releases.

What type of vulnerability is CVE-2020-29475?

CVE-2020-29475 is a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts.

What can an attacker do with CVE-2020-29475?

An attacker exploiting CVE-2020-29475 can inject XSS payloads that trigger when users visit affected pages, potentially stealing sensitive information.

In which version of nopCommerce is CVE-2020-29475 present?

CVE-2020-29475 affects nopCommerce Store version 4.30.