CVE-2020-19007

2020-08-2614:15:10

Google

osv.dev

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.8%

JSON

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user’s browser.

CPENameOperatorVersion
haloeq0.2.0
haloeq0.0.3
haloeq1.1.1
haloeq1.2.0-beta.1
haloeq0.4.2
haloeq0.4.0
haloeq0.0.7
haloeq1.0.2-beta.1
haloeq1.2.0-beta.4
haloeq0.0.1