What’s Vulnerable › Vulnerabilities

CVE-2020-13639

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-31 · updated 2026-06-17
• Weakness: CWE-79

Description

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.

Affected products

• OutSystems Lifetime Management Console: from 11 before 11.7.0 — fixed in 11.7.0
• Outsystems: from 10 before 10.0.1005.2 — fixed in 10.0.1005.2
• OutSystems Platform Server: from 11 before 11.9.0 — fixed in 11.9.0

How to fix

Upgrade to a fixed version: OutSystems Lifetime Management Console 11.7.0; Outsystems 10.0.1005.2; OutSystems Platform Server 11.9.0. Check the vendor advisory for mitigations.

References

• https://labs.integrity.pt/advisories/CVE-2020-13639/
• https://www.outsystems.com/platform/
• https://labs.integrity.pt/advisories/CVE-2020-13639/
• https://www.outsystems.com/platform/

Get alerted when CVE-2020-13639 or the next vulnerability affects your stack