« Volver al listado

CVE-2020-21993

Estado: ModificadaMedia (6.1)—

In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wems — Enterprise Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-21993",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-28T15:15:07.883",
  "references": [
    {
      "url": "https://cxsecurity.com/issue/WLB-2020010032",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5551.php",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cxsecurity.com/issue/WLB-2020010032",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5551.php",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site."
    },
    {
      "lang": "es",
      "value": "En WEMS Limited Enterprise Manager versión 2.58, la entrada pasada al parámetro GET \"email\" no se sanea apropiadamente antes de ser devuelta al usuario. Esto puede ser explotado para ejecutar código HTML arbitrario en la sesión del navegador de un usuario en el contexto de un sitio afectado"
    }
  ],
  "lastModified": "2026-06-17T03:04:01.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wems:enterprise_manager:2.19.7959:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5822030A-6F39-45F3-9B46-F7F3D278EB04"
            },
            {
              "criteria": "cpe:2.3:a:wems:enterprise_manager:2.55.8782:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BB63236-E267-45E0-9E48-D15EBD7DF03C"
            },
            {
              "criteria": "cpe:2.3:a:wems:enterprise_manager:2.55.8806:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B121B5E-B063-4B61-85E8-B79C01CFA575"
            },
            {
              "criteria": "cpe:2.3:a:wems:enterprise_manager:2.58.8903:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB15256B-6CB4-44A0-AF2B-8ACCE16C5ECE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}