CVE-2020-23450

MediumCVSS 5.4

Published: 01/09/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

Stored XSS vulnerability in Spiceworks version 7.5.00107 and earlier. An attacker can inject malicious JavaScript via the name field in the Custom Groups function, which is displayed without sanitization on the /inventory/groups/ page.

Risk Assessment

Risk of user session theft, account takeover, or unauthorized actions in the victim's context, potentially leading to data leakage or system integrity compromise.

Recommendation

Immediately update Spiceworks to the latest available version and implement input sanitization mechanisms in the Custom Groups function.

Original NVD description (English source)

Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization.