medium6.1
CVE-2020-29455
A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to…
Impact
A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartystreets | Liveaddressplugin.Js | Version 3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/smartystreets-archives
- https://jsfiddle.net/smartystreets/Lx2dbsaa/
- https://www.guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure/
- https://github.com/smartystreets-archives
- https://jsfiddle.net/smartystreets/Lx2dbsaa/
- https://www.guidepointsecurity.com/liveaddressplugin-js-vulnerability-disclosure/