CVE-2020-15951

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal credentials.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.bishopfox.com/advisoriesExploit, Third Party Advisory
https://labs.bishopfox.com/advisories/immuta-version-2.8.2Release Notes, Third Party Advisory
https://www.immuta.com/Product
https://labs.bishopfox.com/advisoriesExploit, Third Party Advisory
https://labs.bishopfox.com/advisories/immuta-version-2.8.2Release Notes, Third Party Advisory
https://www.immuta.com/Product

Timeline

Published: Nov 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-159529.0Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. Additionally CVE-2020-159537.4LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and CVE-2020-159546.5KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.CVE-2020-159555.9In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client a CVE-2020-159567.5ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and applic CVE-2020-159577.5An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configure CVE-2020-159588.6An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacke CVE-2020-159594.3Insufficient policy enforcement in networking in Google Chrome prior to 85.0.4183.102 allowed an attacker who convinced the user to enable l CVE-2020-15965.4<p>A information disclosure vulnerability exists when TLS components use weak hash algorithms. An attacker who successfully exploited this v CVE-2020-159608.8Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bounds memor CVE-2020-159619.6Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker who convinced a user to install a m CVE-2020-159628.8Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially perform out of bou