1. Home
  2. CVE Database
  3. CVE-2020-6583
MEDIUM · 6.1

CVE-2020-6583

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator...

Vulnerability Description

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
BigprofOnline Invoicing System<= 2.6

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2020-6583?

CVE-2020-6583 is a vulnerability with a CVSS score of 6.1 (MEDIUM). BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator...

How severe is CVE-2020-6583?

CVE-2020-6583 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-6583?

Check the references section above for vendor advisories and patch information. Affected products include: Bigprof Online Invoicing System.