What is CVE-2020-29025?

CVE-2020-29025 is a medium-severity vulnerability in Secomea Sitemanager Embedded, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-02-16.

How severe is CVE-2020-29025?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Secomea Sitemanager Embedded

CVE-2020-29025

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

Affected products

Secomea Sitemanager_embedded
Secomea Sitemanager Embedded (Sm-e) — versions all

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

VulnerabilityReporting@secomea.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-29025?: CVE-2020-29025 is a medium-severity vulnerability in Secomea Sitemanager Embedded, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2021-02-16.
How severe is CVE-2020-29025?: Medium severity. CVSS v3 base score is 5.4 out of 10.