CVE-2020-36395: XSS

Published Jul 2, 2021

Updated

A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

Affected Software

1 affected component

Lavalite LavaLite=5.8.0

Event History

Jul 2, 2021

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-36395?

CVE-2020-36395 is classified as a medium severity vulnerability due to its potential for cross site scripting attacks.

How do I fix CVE-2020-36395?

To fix CVE-2020-36395, upgrade to a patched version of LavaLite beyond 5.8.0 that addresses this vulnerability.

Who is affected by CVE-2020-36395?

CVE-2020-36395 affects users of LavaLite version 5.8.0 who have administrative access to the application.

What type of attack can be executed by exploiting CVE-2020-36395?

Exploiting CVE-2020-36395 allows authenticated attackers to execute arbitrary web scripts or HTML in the context of the affected application.

Is there a workaround for CVE-2020-36395?

Currently, there are no formal workarounds for CVE-2020-36395 other than upgrading to a secure version.