« Volver al listado

CVE-2020-23048

Estado: ModificadaMedia (6.1)—

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Seeddms — Seeddms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-23048",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-22T20:15:10.293",
  "references": [
    {
      "url": "https://www.vulnerability-lab.com/get_content.php?id=2209",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.vulnerability-lab.com/get_content.php?id=2209",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters."
    },
    {
      "lang": "es",
      "value": "SeedDMS Content Management System versión v6.0.7, contiene una vulnerabilidad de tipo cross-site scripting (XSS) persistente en el componente AddEvent.php por medio de los parámetros name y comment"
    }
  ],
  "lastModified": "2026-06-17T03:04:30.793",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:4.3.37:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE5772DC-DF6D-410C-9869-AC4359C1045C"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:5.0.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93CAD90C-1630-4E68-AF65-1FDA3B11915C"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:5.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0633C41D-2FF7-4036-82E9-836692457336"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:5.1.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "060E3BAC-B7FC-4AC2-97C3-5D7CD917E2BD"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:5.1.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCD565F2-C87C-472A-99FE-BE703D067064"
            },
            {
              "criteria": "cpe:2.3:a:seeddms:seeddms:6.0.7:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FD65D10-9C73-4E23-8DA3-3EB35FD42B92"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}