CVE-2020-13639
Medium
Description
A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Outsystems Lifetime Management Console
PublishedAug 31, 2021
First seenAug 31, 2021
How to fix
Update
- outsystems lifetime_management_console11.7.0 or later
- outsystems outsystems10.0.1005.2 or later
- outsystems platform_server11.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| outsystems lifetime_management_console | 11 ≤ v < 11.7.0 | 11.7.0 |
| outsystems outsystems | 10 ≤ v < 10.0.1005.2 | 10.0.1005.2 |
| outsystems platform_server | 11 ≤ v < 11.9.0 | 11.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.