SquaredUp up to 4.5.x Dashboard cross site scripting

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in SquaredUp up to 4.5.x. It has been rated as problematic. This issue affects an unknown code block of the component Dashboard. Upgrading to version 4.6.0 eliminates this vulnerability.

Field02/04/2021 10:53 AM02/23/2021 01:48 PM
nameSquaredUpSquaredUp
version<=4.5.x<=4.5.x
componentDashboardDashboard
cwe79 (cross site scripting)79 (cross site scripting)
risk11
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiRR
cvss3_vuldb_sUU
cvss3_vuldb_cNN
cvss3_vuldb_iLL
cvss3_vuldb_aNN
cvss3_vuldb_rlOO
cvss3_vuldb_rcCC
urlhttps://support.squaredup.com/hc/en-us/articles/360017568258https://support.squaredup.com/hc/en-us/articles/360017568258
nameUpgradeUpgrade
upgrade_version4.6.04.6.0
cveCVE-2020-9390CVE-2020-9390
date1612393200 (02/04/2021)1612393200 (02/04/2021)
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciNN
cvss2_vuldb_iiPP
cvss2_vuldb_aiNN
cvss2_vuldb_rcCC
cvss2_vuldb_rlOFOF
cvss2_vuldb_auSS
cvss2_vuldb_eNDND
cvss3_vuldb_prLL
cvss3_vuldb_eXX
cvss2_vuldb_basescore4.04.0
cvss2_vuldb_tempscore4.03.5
cvss3_vuldb_basescore3.53.5
cvss3_vuldb_tempscore3.53.4
cvss3_meta_basescore3.53.5
cvss3_meta_tempscore3.53.4
price_0day$0-$5k$0-$5k
cve_assigned1582585200
cve_nvd_summarySquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.
confirm_urlhttps://support.squaredup.com/hc/en-us/articles/360017568258

Want to stay up to date on a daily basis?

Enable the mail alert feature now!