Rukovoditel Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2020-18470 - Vulnerability Database

Rukovoditel

Rukovoditel Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2020-18470

Medium

Reference: CVE-2020-18470

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-18470

Title: Rukovoditel Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to rukovoditel_2.4.1/install/index.php.