CVE-2020-12259

medium · 5.4

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.

5.4

CVSS

96.2%

EPSS (exploit prob.)

100th

EPSS percentile

2020-05-18

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
rconfig	rconfig	3.9.4

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-12259