Vulnerability · Published Apr 10, 2020 · Assigned by certcc

CVE-2020-9056Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting

Low 3.9

In plain English

A low-severity cross-site scripting in BuySpeed from Periscope Holdings. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)3.9Low

Exploit odds (30 days)0.6%top 49.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript within the application. This JavaScript is subsequently displayed by the application without sanitization and is executed in the browser of the user, which could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been patched in BuySpeed version 15.3.

Affected products (as reported)

Vendor	Product	Versions
Periscope Holdings	BuySpeed	14.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References

VU#660597 third-party-advisory, x_refsource_CERT-VN
https://support.buyspeed.com/hc/en-us/articles/360035773831-Buyspeed-15-3-0-Release-Notes x_refsource_MISC