CVE-2020-28502

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	xmlhttprequest	>= unspecified, < 1.7.0
n/a	xmlhttprequest-ssl	< unspecified

References

https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480Broken Link
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936Exploit, Third Party Advisory
https://github.com/driverdan/node-XMLHttpRequest/blob/1.6.0/lib/XMLHttpRequest.js%23L480Broken Link
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082937Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1082938Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUEST-1082935Exploit, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936Exploit, Third Party Advisory

Timeline

Published: Mar 5, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that ar CVE-2020-28534.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar CVE-2020-28548.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-28558.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Admin). Supported versions that are affected are 12.1.1-CVE-2020-28568.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-28578.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: User Interface). Supported versions t CVE-2020-285727.8A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with addition CVE-2020-285735.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285747.5A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow CVE-2020-285756.7A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate