CVE-2020-35206: XSS
UNSUPPORTED WHEN ASSIGNED Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35206?
CVE-2020-35206 is a vulnerability in Quest Policy Authority version 8.1.2.200 that allows attackers to inject malicious code into the browser via a specially crafted link.
What is the severity of CVE-2020-35206?
CVE-2020-35206 has a severity keyword of medium and a severity value of 6.1.
How does CVE-2020-35206 affect Quest Policy Authority?
CVE-2020-35206 affects Quest Policy Authority version 8.1.2.200.
How can an attacker exploit CVE-2020-35206?
An attacker can exploit CVE-2020-35206 by sending a specially crafted link to the cConn.jsp file via the ur parameter.
What is the Common Weakness Enumeration (CWE) for CVE-2020-35206?
The Common Weakness Enumeration (CWE) for CVE-2020-35206 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).