CVE-2020-36634 Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting
Remote attackers can execute arbitrary scripts via cross-site scripting in the ViewExportedVariablesServlet component of the Indeed Engineering util library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-36634?
CVE-2020-36634 is a low-severity cross-site scripting vulnerability in Indeed Engineering util, published on 27 Dec 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2020-36634?
It affects 1 product.
Products include Indeed Util.
How do I fix CVE-2020-36634?
No fix has been published for CVE-2020-36634 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-36634 being exploited?
There is no known exploitation of CVE-2020-36634 in the wild and no public exploit code.
Sources
Also known as GHSA-jpmp-fq2w-x5v7.