A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
References
| Link | Resource |
|---|---|
| http://qcubed.com | Product |
| http://seclists.org/fulldisclosure/2021/Mar/30 | Exploit Mailing List Third Party Advisory |
| https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912 | Exploit Patch Third Party Advisory |
| https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 | Exploit Patch Third Party Advisory |
| http://qcubed.com | Product |
| http://seclists.org/fulldisclosure/2021/Mar/30 | Exploit Mailing List Third Party Advisory |
| https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912 | Exploit Patch Third Party Advisory |
| https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://qcubed.com - Product | |
| References | () http://seclists.org/fulldisclosure/2021/Mar/30 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912 - Exploit, Patch, Third Party Advisory | |
| References | () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03 - Exploit, Patch, Third Party Advisory |
Information
Published : 2021-03-04 13:15
Updated : 2024-11-21 05:16
NVD link : CVE-2020-24912
Mitre link : CVE-2020-24912
CVE.ORG link : CVE-2020-24912
JSON object : View
Products Affected
qcubed
- qcubed
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')