Vulnerability · Published Sep 1, 2020 · Assigned by mitre

CVE-2020-23839

Medium 6.1

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)10.5%top 4.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1330 x_refsource_MISC
http://packetstormsecurity.com/files/162016/GetSimple-CMS-3.3.16-Cross-Site-Scripting-Shell-Upload.html x_refsource_MISC
49726 exploit, x_refsource_EXPLOIT-DB
https://github.com/boku7/CVE-2020-23839 x_refsource_MISC