CVE-2019-20151

An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note field. As a result, the payload is executed by the application's administrator(s).

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2020-08-20

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Treasuryxpress (Treasuryxpress)

References

• https://sion-evans.com/blog/CVE-2019-20151.html