CVE-2020-6876
CVSS V2 Low 3.5
CVSS V3 Medium 5.4
Description
A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04
Overview
- CVE ID
- CVE-2020-6876
- Assigner
- psirt@zte.com.cn
- Vulnerability Status
- Analyzed
- Published Version
- 2020-10-26T16:15:13
- Last Modified Date
- 2020-10-30T16:37:09
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:zte:evdc:zxcloud-irosv6.03.04:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:S/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- SINGLE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 3.5
- Severity
- LOW
- Exploitability Score
- 6.8
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 5.4
- Base Severity
- MEDIUM
- Exploitability Score
- 2.3
- Impact Score
- 2.7
References
Reference URL | Reference Tags |
---|---|
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013782 | Vendor Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-6876 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6876 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-05-10 16:21:28 | Added to TrackCVE | |||
2022-12-05 00:58:00 | 2020-10-26T16:15Z | 2020-10-26T16:15:13 | CVE Published Date | updated |
2022-12-05 00:58:00 | 2020-10-30T16:37:09 | CVE Modified Date | updated | |
2022-12-05 00:58:00 | Analyzed | Vulnerability Status | updated |