1. Home
  2. CVE Database
  3. CVE-2020-29025
MEDIUM · 5.4

CVE-2020-29025

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker t...

Vulnerability Description

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
SecomeaSitemanager Embedded< 9.2c

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2020-29025?

CVE-2020-29025 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker t...

How severe is CVE-2020-29025?

CVE-2020-29025 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-29025?

Check the references section above for vendor advisories and patch information. Affected products include: Secomea Sitemanager Embedded.