CVE-2020-12677

https://notcve.org/view.php?id=CVE-2020-12677

An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input, which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser, aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3, 2018 SP1 - 2018.2 prior to 2018.2.3, 2018 SP2 - 2018.3 prior to 2018.3.7, 2019 - 2019.0 prior to 2019.0.3, 2019.1 - 2019.1 prior to 2019.1.2, and 2019.2 - 2019.2 prior to 2019.2.2. Se detectó un problema en Progress MOVEit Automation Web Admin. Un endpoint de la aplicación Web Admin no pudo sanear adecuadamente una entrada maliciosa, lo que podría permitir a un atacante no autenticado ejecutar código arbitrario en el navegador de una víctima, también se conoce como vulnerabilidad de tipo XSS. • https://community.progress.com/s/article/MOVEit-Automation-Cross-Site-Scripting-Vulnerability-XSS-May-2020 https://docs.ipswitch.com/MOVEit/Automation2018/ReleaseNotes/en/index.htm#33958.htm https://docs.ipswitch.com/MOVEit/Automation2018SP1/ReleaseNotes/en/index.htm#33958.htm https://docs.ipswitch.com/MOVEit/Automation2018SP2/ReleaseNotes/en/index.htm#33958.htm https://docs.ipswitch.com/MOVEit/Automation2019/ReleaseNotes/en/index.htm#33958.htm https://docs.ipswitch.com/MOVEit/Automation2019_1/ReleaseNotes/en/index. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •