CVE-2020-24912

EUVD-2022-5803
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
qcubedqcubed
𝑥
≤ 3.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://qcubed.com
http://seclists.org/fulldisclosure/2021/Mar/30
https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03
http://qcubed.com
http://seclists.org/fulldisclosure/2021/Mar/30
https://tech.feedyourhead.at/content/QCubed-Cross-Site-Scripting-CVE-2020-24912
https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-03