CVE-2020-16230

2020-09-1818:04:16

icscert

www.cve.org

3.5 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

All version of Ewon Flexy and Cosy prior to 14.1 use wildcards such as (*) under which domains can request resources. An attacker with local access and high privileges could inject scripts into the Cross-origin Resource Sharing (CORS) configuration that could abuse this vulnerability, allowing the attacker to retrieve limited confidential information through sniffing.

CNA Affected

[
  {
    "product": "HMS Networks Ewon Flexy and Cosy",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 14.1"
      }
    ]
  }
]

References

us-cert.cisa.gov/ics/advisories/icsa-20-254-03