CVE-2020-28927 Cross-site scripting in n/a
Stored XSS in Magicpin allows attackers to steal admin cookies when the admin views the user management section.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-28927?
CVE-2020-28927 is a medium-severity cross-site scripting vulnerability in n/a, published on 23 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
Weakness: CWE-79
Which versions are affected by CVE-2020-28927?
It affects 1 product.
Products include Magicpin Magicpin.
How do I fix CVE-2020-28927?
No fix has been published for CVE-2020-28927 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-28927 being exploited?
There is no known exploitation of CVE-2020-28927 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6542-cc58-3fvq.