CVE-2020-13972

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-03 · updated 2026-06-17
Weakness: CWE-79

Description

Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.

Affected products

Enghouse Web Chat: 6.2.284.34

References

http://burninatorsec.blogspot.com/2020/09/cve-2020-13972-xss-via-ssrf-in.html
http://burninatorsec.blogspot.com/2020/09/cve-2020-13972-xss-via-ssrf-in.html

Get alerted when CVE-2020-13972 or the next vulnerability affects your stack