What’s Vulnerable › Vulnerabilities

CVE-2020-8020: Persistent XSS in markdown parser used by obs-server

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-13 · updated 2026-06-17
• Weakness: CWE-79

Description

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.

Affected products

• Debian Linux: 9.0
• openSUSE Open Build Service: before 2020-05-13 — fixed in 2020-05-13

How to fix

Upgrade to a fixed version: openSUSE Open Build Service 2020-05-13. Check the vendor advisory for mitigations.

References

• https://bugzilla.suse.com/show_bug.cgi?id=1171439
• https://lists.debian.org/debian-lts-announce/2021/02/msg00006.html
• https://bugzilla.suse.com/show_bug.cgi?id=1171439
• https://lists.debian.org/debian-lts-announce/2021/02/msg00006.html

Get alerted when CVE-2020-8020 or the next vulnerability affects your stack