CVE-2020-35203

Vulnerability

The vulnerability is a reflected cross-site scripting (XSS) in the initFile.jsp endpoint of the Web Compliance Manager component in Quest Policy Authority for Unified Communications version 8.1.2.200. The msg parameter is reflected in the response without sanitization or encoding, allowing injection of arbitrary HTML and JavaScript. No authentication is required to trigger the vulnerability. [1]

Exploitation

An attacker can craft a malicious URL containing a JavaScript payload in the msg parameter, e.g., ?msg=. When a victim clicks the link, the script executes in the context of the application's origin. No prior authentication or special privileges are needed. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, credential theft, or defacement. The attack is limited to the browser context of the application; however, because the product is end-of-life and unsupported, no patch is available. [1]

Mitigation

Quest has confirmed that Policy Authority for Unified Communications version 8.1.2.200 is end-of-life and has been unsupported for over seven years. No patches will be issued. The only mitigation is to decommission or replace the product with a supported alternative. [1]