CVE-2020-13639

Published: Aug 31, 2021Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.

Affected (3)

Products: Outsystems: Lifetime Management Console, Outsystems, Platform Server

3 products

Lifetime Management Console

Platform Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Outsystems Lifetime Management Console	From 11 to 11.7.0
Outsystems Outsystems	From 10 to 10.0.1005.2
Outsystems Platform Server	From 11 to 11.9.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://labs.integrity.pt/advisories/CVE-2020-13639/

Source: cve@mitre.org

Third Party Advisory

https://www.outsystems.com/platform/

Source: cve@mitre.org

Product

https://labs.integrity.pt/advisories/CVE-2020-13639/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.outsystems.com/platform/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.