CVE-2020-35705: XSS
Published Dec 25, 2020
·Updated
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
Affected Software
1 affected component
Daybydaycrm Daybyday=2.1.0
Event History
Dec 25, 2020
CVE Published
via MITRE·05:24 AM
Data Sourced
via MITRE·05:24 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-35705?
CVE-2020-35705 is considered a medium severity vulnerability due to potential data compromise through stored XSS.
2
How does CVE-2020-35705 affect users?
CVE-2020-35705 allows attackers to execute arbitrary JavaScript in the browser of users who visit a compromised New User screen.
3
How do I fix CVE-2020-35705?
To fix CVE-2020-35705, update Daybyday to version 2.1.1 or later, where the vulnerability is patched.
4
What is the cause of CVE-2020-35705?
CVE-2020-35705 is caused by insufficient input sanitization for the Name parameter in the New User feature.
5
Who is affected by CVE-2020-35705?
Users of Daybyday CRM version 2.1.0 are specifically affected by CVE-2020-35705 due to the stored XSS vulnerability.