CVE-2020-22789

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-VulnerabilitiesVendor Advisory
https://community.safe.com/s/article/fme-server-2019-security-updateVendor Advisory
https://mexicanpentester.com/2020/04/09/vulnerabilities-in-fme-server-versions-2019-2-and-2020-0-beta-and-probably-previous-versions/Exploit, Third Party Advisory
https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-VulnerabilitiesVendor Advisory
https://community.safe.com/s/article/fme-server-2019-security-updateVendor Advisory
https://mexicanpentester.com/2020/04/09/vulnerabilities-in-fme-server-versions-2019-2-and-2020-0-beta-and-probably-previous-versions/Exploit, Third Party Advisory

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-22799.9A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.74 and earlier allows attackers with permission to define sandboxed scrip CVE-2020-227905.4Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web sc CVE-2020-22808.8A cross-site request forgery (CSRF) vulnerability in Jenkins Warnings Plugin 5.0.1 and earlier allows attackers to execute arbitrary code.CVE-2020-228079.8An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature.CVE-2020-228086.1An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.CVE-2020-228097.8In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.CVE-2020-22815.4A cross-site request forgery (CSRF) vulnerability in Jenkins Lockable Resources Plugin 2.8 and earlier allows attackers to reserve, unreserv CVE-2020-228189.8MKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.CVE-2020-228199.8MKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.CVE-2020-22824.3Jenkins Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read CVE-2020-228209.8MKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.CVE-2020-22835.4Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulne