CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.1. It affects Java. Exploitation may require the attacker to be authenticated.
CVE
CVE-2020-25205
Severity
MEDIUM
CVSS
6.1
EPSS
0.91%
Java
Original NVD Description
The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file, stored on the device's filesystem, to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.
Related CVEs
Other vulnerabilities affecting the same vendor(s)