CVE-2020-28727
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability was discovered in SeedDMS 6.0.13 via the folderid parameter in views/bootstrap/class.DropFolderChooser.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Risk Assessment
The risk includes potential session hijacking, data theft, or phishing attacks within the SeedDMS application context. This could compromise the confidentiality and integrity of data stored in the system.
Recommendation
Immediately update SeedDMS to the latest available version that includes a fix for the XSS vulnerability. If an update is not possible, implement server-side filtering and validation of the folderid parameter.
Other vulnerabilities in SeedDMS
See all- CVE-2021-26216Medium
SeedDMS 5.1.x is affected by a cross-site request forgery (CSRF) vulnerability in out.EditFolder.php. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.
- CVE-2021-26215Medium
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of a victim.
Original NVD description (English source)
Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS