#VU45717 Cross-site scripting in Intel products - CVE-2020-8723

Vulnerability identifier: #VU45717

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-8723

CWE-ID: CWE-79

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerable software:
Intel Server System R1000WT
Intel Server System R2000WT
Intel Server Boards S2600WT
Intel Server Board S2600CW
Intel Compute Module HNS2600KP
Intel Server Board S2600KP
Intel Compute Module HNS2600TP
Intel Server Board S2600TP
Intel Server System R1000SP
Intel Server System LSVRP
Intel Server System LR1304SP
Intel Server Board S1200SP
Intel Server System R1000WF
Intel Server System R2000WF
Intel Server Board S2600WF
Intel Server Board S2600ST
Intel Compute Module HNS2600BP
Intel Server Board S2600BP

Software vendor:
Intel

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker on the local network can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00384.html