CVE-2020-13639
MEDIUM EPSS 52.6%
Published Aug 31, 20214y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Published Aug 31, 2021 4y ago
Last Modified Jun 17, 2026 2w ago
Description
A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
52.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 3
| Vendor | Product | Version | Range |
|---|---|---|---|
| outsystems | lifetime_management_console | * | ≥11 – <11.7.0 |
| outsystems | outsystems | * | ≥10 – <10.0.1005.2 |
| outsystems | platform_server | * | ≥11 – <11.9.0 |
References 2
- labs.integrity.pt https://labs.integrity.pt/advisories/CVE-2020-13639/
- outsystems.com https://www.outsystems.com/platform/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.