CVE-2020-27576
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.
Risk Assessment
Attackers can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browsers, compromising data confidentiality and integrity within the organization.
Recommendation
Immediately upgrade Maxum Rumpus to a version later than 8.2.14 that fixes folder name validation. If no update is available, restrict access to the application and manually validate folder names.
Other vulnerabilities in Maxum Rumpus
See all- CVE-2020-27575High
Maxum Rumpus 8.2.13 and 8.2.14 are affected by a command injection vulnerability. The user management functionality in the web administration panel contains a parameter that, due to insufficient validation, allows execution of arbitrary system commands.
- CVE-2020-27574High
A CSRF vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows an attacker to perform unintended actions in the web application if an authenticated user visits a malicious page.
Original NVD description (English source)
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS