CVE-2020-15307

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-30 · updated 2026-06-17
Weakness: CWE-79

Description

Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name.

Affected products

Nozomi Networks Guardian: before 19.0.4 — fixed in 19.0.4

How to fix

Upgrade to a fixed version: Nozomi Networks Guardian 19.0.4. Check the vendor advisory for mitigations.

References

https://www2.deloitte.com/de/de/pages/risk/articles/nozomi-stored-xss.html?nc=1
https://www2.deloitte.com/de/de/pages/risk/articles/nozomi-stored-xss.html?nc=1

Get alerted when CVE-2020-15307 or the next vulnerability affects your stack