Sign-up

ID

VAR-202007-1342


CVE

CVE-2020-6872


TITLE

ZTE Cross-site scripting vulnerability in server management software

Trust: 0.8

sources: JVNDB: JVNDB-2020-008224

DESCRIPTION

The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>. Shenzhen Zhongxing Mobile Communication Co., Ltd. was established in 2002 and is headquartered in Shenzhen High-tech Industrial Park. It is a national high-tech enterprise. Attackers can use the vulnerability to obtain user cookie information

Trust: 2.16

sources: NVD: CVE-2020-6872 // JVNDB: JVNDB-2020-008224 // CNVD: CNVD-2020-41508

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-41508

AFFECTED PRODUCTS

vendor:ztemodel:r5300g4scope:eqversion:03.08.0100

Trust: 1.0

vendor:ztemodel:r8500g4scope:eqversion:03.05.0020

Trust: 1.0

vendor:ztemodel:r5500g4scope:eqversion:03.07.0100

Trust: 1.0

vendor:ztemodel:r8500g4scope:eqversion:03.07.0103

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0044

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0046

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.07.0300

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.07.0100

Trust: 1.0

vendor:ztemodel:r8500g4scope:eqversion:03.06.0100

Trust: 1.0

vendor:ztemodel:r8500g4scope:eqversion:03.07.0101

Trust: 1.0

vendor:ztemodel:r5500g4scope:eqversion:03.07.0200

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.04.0020

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0040

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.07.0200

Trust: 1.0

vendor:ztemodel:r5500g4scope:eqversion:03.06.0100

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.07.0108

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0045

Trust: 1.0

vendor:ztemodel:r8500g4scope:eqversion:03.05.0400

Trust: 1.0

vendor:ztemodel:r5500g4scope:eqversion:03.08.0100

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0043

Trust: 1.0

vendor:ztemodel:r5300g4scope:eqversion:03.05.0047

Trust: 1.0

vendor:ztemodel:r5300g4scope: - version: -

Trust: 0.8

vendor:ztemodel:r5500g4scope: - version: -

Trust: 0.8

vendor:ztemodel:r8500g4scope: - version: -

Trust: 0.8

vendor:zte mobilemodel:psirt r5300g4scope:eqversion:v03.08.0200

Trust: 0.6

vendor:zte mobilemodel:psirt r8500g4scope:eqversion:v03.08.0200

Trust: 0.6

vendor:zte mobilemodel:psirt r5500g4scope:eqversion:v03.08.0200

Trust: 0.6

sources: CNVD: CNVD-2020-41508 // JVNDB: JVNDB-2020-008224 // NVD: CVE-2020-6872

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-6872
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-008224
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2020-41508
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202007-1317
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2020-6872
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-008224
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-41508
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-6872
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-008224
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-41508 // JVNDB: JVNDB-2020-008224 // CNNVD: CNNVD-202007-1317 // NVD: CVE-2020-6872

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2020-008224 // NVD: CVE-2020-6872

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202007-1317

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202007-1317

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-008224

PATCH
title:1013203url:http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203
Trust: 0.8
title:ZTE R5300G4 , R8500G4  and R5500G4 Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=124982
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2020-008224 // 
            
            
            
            CNNVD: CNNVD-202007-1317

EXTERNAL IDS
db:NVDid:CVE-2020-6872
Trust: 3.0
db:ZTEid:1013203
Trust: 1.6
db:JVNDBid:JVNDB-2020-008224
Trust: 0.8
db:CNVDid:CNVD-2020-41508
Trust: 0.6
db:CNNVDid:CNNVD-202007-1317
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-41508 // 
            
            
            
            JVNDB: JVNDB-2020-008224 // 
            
            
            
            CNNVD: CNNVD-202007-1317 // 
            
            
            
            NVD: CVE-2020-6872

REFERENCES
url:http://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1013203
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2020-6872
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6872
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2020-008224 // 
            
            
            
            CNNVD: CNNVD-202007-1317 // 
            
            
            
            NVD: CVE-2020-6872

SOURCES
db:CNVDid:CNVD-2020-41508
db:JVNDBid:JVNDB-2020-008224
db:CNNVDid:CNNVD-202007-1317
db:NVDid:CVE-2020-6872

LAST UPDATE DATE
2024-11-23T21:35:25.699000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-41508date:2020-07-27T00:00:00
db:JVNDBid:JVNDB-2020-008224date:2020-09-07T00:00:00
db:CNNVDid:CNNVD-202007-1317date:2020-07-27T00:00:00
db:NVDid:CVE-2020-6872date:2024-11-21T05:36:19.900

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-41508date:2020-09-04T00:00:00
db:JVNDBid:JVNDB-2020-008224date:2020-09-07T00:00:00
db:CNNVDid:CNNVD-202007-1317date:2020-07-20T00:00:00
db:NVDid:CVE-2020-6872date:2020-07-20T18:15:12.623