CVE-2020-37044: OpenCTI 3.3.1 - Cross Site Scripting
OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For example, a request to /graphql?'"--></style></scRipt><scRipt>alert('RaifBerkay')</scRipt> will trigger an alert. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37044?
CVE-2020-37044 is rated as a medium severity vulnerability due to its potential to allow arbitrary JavaScript execution via reflected cross-site scripting.
How do I fix CVE-2020-37044?
To mitigate CVE-2020-37044, upgrade OpenCTI to a version later than 3.3.1 that addresses the reflected cross-site scripting vulnerability.
What are the impacts of CVE-2020-37044?
The impact of CVE-2020-37044 includes the possibility for attackers to execute malicious JavaScript code in the context of affected users.
Which versions of OpenCTI are affected by CVE-2020-37044?
OpenCTI versions up to and including 3.3.1 are affected by CVE-2020-37044.
Is CVE-2020-37044 an easy vulnerability to exploit?
Yes, CVE-2020-37044 can be easily exploited by sending a crafted GET request with a malicious payload in the query string.