CVE-2020-8985: zend zendto Cross-site Scripting
CVSS: 8.8v3.1HighModified
Published 24-03-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-8985 is a high (CVSS 8.8) Cross-site Scripting vulnerability in zend zendto. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.8% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 24-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
CVSS metrics
2 scores · 1 source · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 22-09-2026
22-09-202622-10-2026
EPSS score0.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Zend1 product
- zendto3.10 | 3.11 | 3.12 | 3.13 | 3.20 | 3.51 | 3.52 | 3.53 | 3.54 | 3.55 | 3.56-2 | 3.57 | 3.58 | 3.59 | 3.60 | 3.61 | 3.62 | 3.63 | 3.64 | 3.65 | 3.70-2 | 3.71 | 3.72 | 3.73 | 3.74 | 3.75 | 3.90 | 3.91 | 3.92 | 3.93 | 3.94 | 4.00 | 4.01 | 4.02 | 4.03-3 | 4.05-2 | 4.06-2 | 4.07-1 | 4.08-4 | 4.09-1 | 4.10-4 | 4.10-5 | 4.11-1 | 4.11-2 | 4.11-3 | 4.11-4 | 4.11-5 | 4.11-7 | 4.11-8 | 4.11-9 | 4.11-10 | 4.11-11 | 4.11-12 | 4.11-13 | 4.11-14 | 4.12-5 | 4.12-6 | 4.13-1 | 4.20-2 | 4.20-3 | 4.20-5 | 4.20-6 | 4.20-7 | 4.25-3 | 4.27-1 | 4.27-2 | 4.27-4 | 4.27-5 | 4.27-6 | 4.27-7 | 4.28-1 | 4.28-2 | 5.00-1 | 5.00-2 | 5.01-5 | 5.02-5 | 5.03-1 | 5.04-7 | 5.09-13 | 5.10-1 | 5.10-2 | 5.11-1 | 5.11-2 | 5.11-3 | 5.11-4 | 5.11-5 | 5.11-6 | 5.12-3:beta | 5.12-4:beta | 5.12-6:beta | 5.12-7:beta | 5.12-8:beta | 5.13-1 | 5.13-2 | 5.14-2:beta | 5.14-5:beta | 5.15-1 | 5.16-1:beta | 5.16-4:beta | 5.16-5:beta | 5.16-7:beta | 5.16-8:beta | 5.16.6:beta | 5.17-1 | 5.17-2 | 5.17-3 | 5.17-4 | 5.17-5:beta | 5.17-6 | 5.18-1:beta | 5.18-2:beta | 5.19-1:production | 5.20-1:beta | 5.20-2:beta | 5.20-3:beta | 5.20-5:beta | 5.20-6:beta | 5.20-7:beta | 5.20-8:beta | 5.20-9:beta | 5.21-1:production | 5.21-2:production | 5.22-1:beta
1 vendor · 1 product