CVE-2020-36397: XSS

Published Jul 2, 2021

Updated

A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.

Affected Software

1 affected component

Lavalite LavaLite=5.8.0

Event History

Jul 2, 2021

CVE Published

via MITRE·05:51 PM

Data Sourced

via MITRE·05:51 PM

Description

Frequently Asked Questions

What is CVE-2020-36397?

CVE-2020-36397 is a stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0.

How does CVE-2020-36397 affect LavaLite?

CVE-2020-36397 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New' parameter of the /admin/contact/contact component.

What is the severity of CVE-2020-36397?

The severity of CVE-2020-36397 is medium, with a CVSS score of 5.4.

What is the Common Weakness Enumeration (CWE) for CVE-2020-36397?

The CWE for CVE-2020-36397 is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')).

How can I fix the CVE-2020-36397 vulnerability in LavaLite 5.8.0?

To fix the CVE-2020-36397 vulnerability in LavaLite 5.8.0, update to a version that is not affected by this vulnerability.