Medium severity · published Dec 7, 2021
CVE-2020-19611
Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Racktables · Racktables Project
0.21.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-19611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-19611
Patch
https://github.com/RackTables/racktables/commit/2ce35adeaa47f60dc51875b2339725db3b23e827
More from Racktables
6.1
CVE-2023-49453
Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive information via the…