Lucene search

[email protected]CVE-2020-35203

HistoryJan 11, 2021 - 3:15 a.m.

CVE-2020-35203

2021-01-1103:15:13

CWE-79

[email protected]

web.nvd.nist.gov

cve

2020

35203

reflected xss

web compliance manager

quest policy authority

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.6%

JSON

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected configurations

NVD

Node

questpolicy_authority_for_unified_communicationsMatch8.1.2.200

CPENameOperatorVersion
quest:policy_authority_for_unified_communicationsquest policy authority for unified communicationseq8.1.2.200

CPE	Name	Operator	Version
quest:policy_authority_for_unified_communications	quest policy authority for unified communications	eq	8.1.2.200

References

clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

31.6%

JSON

Related for CVE-2020-35203

prion1 cvelist1 nvd1