CVE-2020-35720 : What You Need to Know

Quest Policy Authority 8.1.2.200 is affected by a Stored XSS vulnerability that enables remote attackers to inject malicious code into various fields during user creation or modification.

Understanding CVE-2020-35720

This CVE involves a security issue in Quest Policy Authority 8.1.2.200 that allows the storage of malicious scripts in specific user fields.

What is CVE-2020-35720?

Stored XSS in Quest Policy Authority 8.1.2.200 permits attackers to insert harmful code into fields like first name, last name, and logon name via the submitUser.jsp file. Notably, this vulnerability impacts only products that are no longer supported by the maintainer.

The Impact of CVE-2020-35720

The vulnerability poses a risk of executing unauthorized code within the application, potentially leading to various security breaches and compromises.

Technical Details of CVE-2020-35720

Quest Policy Authority 8.1.2.200's vulnerability to Stored XSS can have severe consequences if exploited.

Vulnerability Description

The flaw allows remote attackers to store and execute malicious scripts in critical user fields, compromising the application's security.

Affected Systems and Versions

Product: Quest Policy Authority 8.1.2.200
Vendor: Quest
Versions: All versions are affected

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating the user creation or modification process to inject harmful code into specific fields.

Mitigation and Prevention

It is crucial to take immediate action to address and prevent the exploitation of CVE-2020-35720.

Immediate Steps to Take

Disable or restrict access to the vulnerable application if possible.
Implement input validation mechanisms to sanitize user inputs and prevent script injection.
Regularly monitor and audit user accounts and activities for any suspicious behavior.

Long-Term Security Practices

Keep software and applications up to date to prevent known vulnerabilities.
Conduct regular security assessments and penetration testing to identify and address potential weaknesses.
Educate users on safe computing practices and the risks of social engineering attacks.

Patching and Updates

Seek patches or updates from the vendor to fix the vulnerability and enhance the application's security.