CVE-2020-14014

low-risk
Published 2020-06-24

An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding, making it vulnerable to reflected XSS.

Do I need to act?

-
0.21% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Naviwebs

References (4)

Exploit https://blog.sean-wright.com/navigate-cms/
Third Party Advisory https://cxsecurity.com/issue/WLB-2018090182
Exploit https://blog.sean-wright.com/navigate-cms/
Third Party Advisory https://cxsecurity.com/issue/WLB-2018090182
29
/ 100
low-risk
Severity 21/34 · High
Exploitability 1/34 · Minimal
Exposure 7/34 · Low