Cross-site scripting in Navigate CMS - CVE-2020-14014
Published: June 24, 2020 / Updated: August 8, 2020
Vulnerability identifier: #VU34194
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-14014
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Naviwebs
Affected software:
Navigate CMS
Navigate CMS
Detailed vulnerability description
The vulnerability allows a remote authenticated user to read and manipulate data.
An issue was discovered in Navigate CMS 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS.
How to mitigate CVE-2020-14014
Install update from vendor's website.