CVE-2020-9520

Published: Mar 25, 2020Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. The vulnerability could allows a remote attacker to craft and store malicious content into Vibe such that when the content is viewed by another user of the system, attacker controlled JavaScript will execute in the security context of the target user’s browser.

Affected (1)

Products: Microfocus: Vibe

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microfocus Vibe	Before 4.0.7

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

http://seclists.org/fulldisclosure/2020/Mar/50

Source: security@opentext.com

https://softwaresupport.softwaregrp.com/doc/KM03630475

Source: security@opentext.com

http://seclists.org/fulldisclosure/2020/Mar/50

Source: af854a3a-2127-422b-91ae-364da2661108

https://softwaresupport.softwaregrp.com/doc/KM03630475

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.