CVE-2020-7050: XSS
Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cookies and take over accounts.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2020-7050.
What is the severity rating of CVE-2020-7050?
The severity rating of CVE-2020-7050 is medium.
How does CVE-2020-7050 affect Codologic Codoforum?
CVE-2020-7050 allows a DOM-based XSS in Codologic Codoforum through version 4.8.4.
What can an attacker do with this vulnerability?
An attacker can steal authentication cookies by exploiting this vulnerability.
Are there any references available for CVE-2020-7050?
Yes, you can find references for CVE-2020-7050 at the following links: [link1](https://codologic.com/forum/index.php?u=/topic/12638/codoforum-4-8-8-released-and-the-future#post-23845) and [link2](https://www.linkedin.com/posts/polina-voronina-896819b5_discovered-by-polina-voronina-jan-15-activity-6634436086540054528-dDgg/).