Vulnerability Details CVE-2020-9028
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 55.0%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
Products affected by CVE-2020-9028
-
cpe:2.3:h:microchip:syncserver_s100:-
-
cpe:2.3:h:microchip:syncserver_s200:-
-
cpe:2.3:h:microchip:syncserver_s250:-
-
cpe:2.3:h:microchip:syncserver_s300:-
-
cpe:2.3:h:microchip:syncserver_s350:-
-
cpe:2.3:o:microchip:syncserver_s100_firmware:2.90.70.3
-
cpe:2.3:o:microchip:syncserver_s200_firmware:1.30
-
cpe:2.3:o:microchip:syncserver_s250_firmware:1.25
-
cpe:2.3:o:microchip:syncserver_s300_firmware:2.65.0
-
cpe:2.3:o:microchip:syncserver_s350_firmware:2.80.1