CVE-2020-11499

2020-04-0223:15:13

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py.

CPENameOperatorVersion
fact_coreeq2.2
fact_coreeq2.4
fact_coreeq2.3
fact_coreeq2.5
fact_coreeq2.6
fact_coreeq3.0

Name	Operator	Version
fact_core	eq	2.2
fact_core	eq	2.4
fact_core	eq	2.3
fact_core	eq	2.5
fact_core	eq	2.6
fact_core	eq	3.0

References

github.com/fkie-cad/FACT_core/issues/375

github.com/fkie-cad/FACT_core/pull/376