VULNERABILITY INTELLIGENCE

CVE-2020-14988

CVSS score5.4 MEDIUM
EPSS probability0.60%
CISA KEVNot currently listed
Published2021-03-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter, the text editor via the src attribute of HTML elements, the translations menu via the foldername parameter, the author page via the link URL, or the upload image functionality via an SVG document containing JavaScript.

Weakness classification

  • nvd@nist.gov: CWE-79

Primary references