CVE-2020-16270

medium · 6.1

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of targeted application and perform phishing-related attacks. Vulnerable application used in more than 3000 organizations in different sectors from retail to industries.

6.1

CVSS

13.1%

EPSS (exploit prob.)

96th

EPSS percentile

2020-10-16

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
olimpoks	olimpok	< 3.3.39

Check a specific version with /api/v1/cve/match.

References

https://bdu.fstec.ru/vul/2020-04623
https://github.com/Security-AVS/CVE-2020-16270
https://olimpoks.ru/oks/forum/olimpoks5.php
https://bdu.fstec.ru/vul/2020-04623
https://github.com/Security-AVS/CVE-2020-16270
https://olimpoks.ru/oks/forum/olimpoks5.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-16270