VULNERABILITY INTELLIGENCE

CVE-2020-5223

CVSS score6.1 MEDIUM

EPSS probability0.66%

CISA KEVNot currently listed

Published2020-01-23

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

Description

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.

Weakness classification

security-advisories@github.com: CWE-79
nvd@nist.gov: CWE-79

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Third Party Advisory
security-advisories@github.com — Exploit, Third Party Advisory
security-advisories@github.com — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory