In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks.
References
Link | Resource |
---|---|
http://vfairs.com | Vendor Advisory |
https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack | Third Party Advisory |
http://vfairs.com | Vendor Advisory |
https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:20
Type | Values Removed | Values Added |
---|---|---|
References | () http://vfairs.com - Vendor Advisory | |
References | () https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack - Third Party Advisory |
01 Jun 2021, 13:34
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://vfairs.com - Vendor Advisory | |
References | (MISC) https://www.huntress.com/blog/zero-day-vulnerabilities-in-popular-event-management-platforms-could-leave-msps-open-to-attack - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
CWE | CWE-79 | |
CPE | cpe:2.3:a:vfairs:vfairs:3.3:*:*:*:*:*:*:* |
26 May 2021, 12:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-05-26 12:15
Updated : 2024-11-21 05:20
NVD link : CVE-2020-26680
Mitre link : CVE-2020-26680
CVE.ORG link : CVE-2020-26680
JSON object : View
Products Affected
vfairs
- vfairs
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')