CVE-2020-22158

MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2020-09-14

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Rx8200 Firmware (Mediakind)

References

• https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.html