CVE-2020-4070 MEDIUM

CVE-2020-4070: Cross-site Scripting in CSS Validator

Vendor World Wide Web Consortium (W3C)
Product CSS Validator
Weakness CWE-79 · XSS
Published June 22, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.

Key dates

02Disclosure timeline

June 22, 2020 CVE published
August 4, 2024 Record updated