CVE-2020-5142

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SonicWall	SonicOS	SonicOS 6.5.4.7-79n and earlier; SonicOS 5.9.1.7-2n and earlier; SonicOS 5.9.1.13-5n and earlier; SonicOS 6.5.1.11-4n and earlier; SonicOS 6.0.5.3-93o and earlier; SonicOSv 6.5.4.4-44v-21-794 and earlier; SonicOS 7.0.0.0-1

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0017Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0017Vendor Advisory

Timeline

Published: Oct 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-51435.3SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based o CVE-2020-51447.8SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SYSTEM through loaded CVE-2020-51458.6SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful explo CVE-2020-51467.2A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST paramet CVE-2020-51475.3SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privil CVE-2020-51488.2SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a poten CVE-2020-51797.2Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagn CVE-2020-51807.8Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a maliciou CVE-2020-51826.5The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link to the business websi CVE-2020-51837.5FTPGetter Professional 5.97.0.223 is vulnerable to a memory corruption bug when a user sends a specially crafted string to the application. CVE-2020-51865.4DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).CVE-2020-51878.8DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).