CVE-2020-25470

2020-10-2614:15:13

Google

osv.dev

antsword

cross-site scripting

xss

remote code execution

view site

cookies view

AI Score

5.9

Confidence

High

EPSS

0.001

Percentile

48.1%

JSON

AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.

References

github.com/AntSwordProject/antSword/issues/256