CVE-2020-7809

low-risk

Published 2020-05-15

ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file.

Do I need to act?

0.26% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.4/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Alsong

Affected Vendors

Altools

References (4)

Vendor Advisory https://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t=

Third Party Advisory https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35409

Vendor Advisory https://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t=

Third Party Advisory https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35409

/ 100

low-risk

Severity 15/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal