CVE-2020-23839

GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting

Severity Score

6.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.

Una vulnerabilidad Cross-Site Scripting (XSS) Reflejado en GetSimple CMS versión v3.3.16, en la página web del portal de inicio de sesión admin/index.php, permite a atacantes remotos ejecutar código JavaScript en el navegador del cliente y recolectar credenciales de inicio de sesión después de que un cliente haga clic en un enlace, ingrese credenciales y envíe el formulario de inicio de sesión

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-08-13 CVE Reserved
2020-09-01 CVE Published
2021-03-30 First Exploit
2024-08-04 CVE Updated
2024-12-26 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (5)

URL	Tag	Source
http://packetstormsecurity.com/files/162016/GetSimple-CMS-3.3.16-Cross-Site-Scripting-Shell-Upload.html	Third Party Advisory

URL	Date	SRC
https://packetstorm.news/files/id/162016	2021-03-30
https://www.exploit-db.com/exploits/49726	2024-08-04
https://github.com/boku7/CVE-2020-23839	2024-08-04
https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1330	2024-08-04

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Get-simple Search vendor "Get-simple"		Getsimple Cms Search vendor "Get-simple" for product "Getsimple Cms"				3.3.16 Search vendor "Get-simple" for product "Getsimple Cms" and version "3.3.16"		-		Affected