Vulnerability · Published Oct 20, 2020 · Assigned by adobe

CVE-2020-24416Blind stored XSS in Marketo Sales insight plugin for SalesForce

High 7.5

In plain English

A high-severity cross-site scripting in Marketo from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)1.9%top 20.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Marketo Sales Insight plugin version 1.4355 (and earlier) is affected by a blind stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Affected products (as reported)

Vendor	Product	Versions
Adobe	Marketo	unspecified – through 1.4355unspecified – through None

Weakness: CWE-79 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://helpx.adobe.com/security/products/marketo/apsb20-60.html x_refsource_MISC