Lucene search

[email protected]CVE-2020-35753

HistoryJan 26, 2021 - 6:15 p.m.

CVE-2020-35753

2021-01-2618:15:54

CWE-79

[email protected]

web.nvd.nist.gov

persis hrm portal

job posting

xss

sender parameter

cve-2020-35753

security vulnerability

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.0%

JSON

The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20), when the “Recommend job posting” function is enabled, allows XSS via the SENDER parameter.

Affected configurations

NVD

Node

persishuman_resource_management_portalRange17.2.00–17.2.35

persishuman_resource_management_portalRange19.0.00–19.0.20

AND

linuxlinux_kernelMatch-

microsoftwindowsMatch-

CPENameOperatorVersion
persis:human_resource_management_portalpersis human resource management portalle17.2.35
persis:human_resource_management_portalpersis human resource management portalle19.0.20

CPE	Name	Operator	Version
persis:human_resource_management_portal	persis human resource management portal	le	17.2.35
persis:human_resource_management_portal	persis human resource management portal	le	19.0.20

References

it-sec.de/ger/Aktuelles-Termine/it.sec-blog/it.sec-Research-Team-findet-unbekannte-Schwachstelle-in-Persis-Online-Bewerberportal

slashcrypto.org/2021/02/20/CVE-2020-35753/

Social References

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.0%

JSON

Related for CVE-2020-35753

nvd1 cvelist1 prion1