XSS in Marmind
CVE-2020-26505
A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.007 (51.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 51.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Marmind — versions 4.1.141.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.marmind.com/en/ (Vendor Advisory)
- www2.deloitte.com/de/de/pages/risk/articles/marmind-xss.html (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-26505?
- CVE-2020-26505 is a medium-severity vulnerability in Marmind, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-11-05.
- How severe is CVE-2020-26505?
- Medium severity. CVSS v3 base score is 6.1 out of 10.
- Is CVE-2020-26505 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.