CVE-2020-12256

EUVD-2020-4570
rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
rconfigrconfig
3.9.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8