Lucene search

MitreCVE-2020-14294

HistoryOct 02, 2020 - 9:15 a.m.

CVE-2020-14294

2020-10-0209:15:13

CWE-79

mitre

web.nvd.nist.gov

cve-2020-14294

secudos

qiata

fta

persistent xss

security issue

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

65.9%

JSON

An issue was discovered in Secudos Qiata FTA 1.70.19. The comment feature allows persistent XSS that is executed when reading transfer comments or the global notice board.

Affected configurations

Nvd

Node

secudosqiata_ftaRange≤1.70.19

VendorProductVersionCPE
secudosqiata_fta*cpe:2.3:a:secudos:qiata_fta:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
secudos	qiata_fta	*	cpe:2.3:a:secudos:qiata_fta::::::::

References

seclists.org/fulldisclosure/2020/Sep/50

github.com/patrickhener/CVE-2020-14294

www.qiata.com

www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-024.txt

www.syss.de/pentest-blog/syss-2020-024-und-syss-2020-025-zwei-schwachstellen-in-file-transfer-loesung-von-qiata

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

65.9%

JSON

Related for CVE-2020-14294