What’s Vulnerable › Vulnerabilities

CVE-2020-11103

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-30 · updated 2026-06-17

Description

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.

Affected products

• Webswing: before 2.6.12; from 2.7 before 20.1 — fixed in 2.6.12, 20.1

How to fix

Upgrade to a fixed version: Webswing 2.6.12, 20.1. Check the vendor advisory for mitigations.

References

• https://bitbucket.org/meszarv/webswing/issues/375/webswing-jslink-mechanism-remote-code
• https://www.webswing.org/docs/2.6/discover/release_notes.html#release-notes-2-6-12
• https://bitbucket.org/meszarv/webswing/issues/375/webswing-jslink-mechanism-remote-code
• https://www.webswing.org/docs/2.6/discover/release_notes.html#release-notes-2-6-12

Get alerted when CVE-2020-11103 or the next vulnerability affects your stack