CVE-2020-36501: XSS
Published Oct 22, 2021
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
Affected Software
1 affected component
SugarCRM SugarCRM=6.5.18
Event History
Oct 22, 2021
CVE Published
via MITRE·07:19 PM
Data Sourced
via MITRE·07:19 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for these cross-site scripting (XSS) vulnerabilities in SugarCRM?
The vulnerability ID is CVE-2020-36501.
2
What is the severity rating of CVE-2020-36501?
The severity rating of CVE-2020-36501 is medium, with a CVSS score of 5.4.
3
Which version of SugarCRM is affected by CVE-2020-36501?
The version affected by CVE-2020-36501 is SugarCRM v6.5.18.
4
How can attackers exploit CVE-2020-36501?
Attackers can exploit CVE-2020-36501 by entering crafted payloads into the primary address state or alternate address state input fields in the Support module of SugarCRM.
5
Is there a fix available for CVE-2020-36501?
Yes, it is recommended to upgrade to a patched version of SugarCRM to mitigate CVE-2020-36501.