CVE-2020-27576

MediumCVSS 5.4

Published: 08/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability in Maxum Rumpus 8.2.13 and 8.2.14 allows attackers to inject malicious scripts via folder names. Insufficient input validation leads to persistent script storage on the server.

Risk Assessment

Attackers can steal user sessions, redirect users to malicious sites, or perform other actions in the context of their browsers, compromising data confidentiality and integrity within the organization.

Recommendation

Immediately upgrade Maxum Rumpus to a version later than 8.2.14 that fixes folder name validation. If no update is available, restrict access to the application and manually validate folder names.

Original NVD description (English source)

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability.