CVE-2020-5223 - CVE House

Back to Database

Status published Medium CVE-2020-5223

Persistent XSS vulnerability in filename of attached file in PrivateBin

6.1 CVSS

Vulnerability Description

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5223

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from PrivateBin

View All →

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users

PrivateBin persistent HTML injection in attachment filename enables redirect and defacement

PrivateBin allows shortening of URLs for other domains

Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

Affected Vendor

PrivateBin

View all reports →

Affected Software

PrivateBin

Vulnerable Versions:

>= 1.2.0, < 1.2.2, >= 1.3.0, < 1.3.2

Timeline

Official Publish: January 23rd, 2020

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement