CVE-2020-36960

Vulnerability

Overview

Forma LMS version 2.3 contains a stored cross-site scripting (XSS) vulnerability in the user profile first and last name fields. The application fails to properly sanitize user input before storing it, allowing attackers to inject arbitrary JavaScript code. This is a classic case of CWE-79: Improper Neutralization of Input During Web Page Generation [1].

Exploitation

An attacker with a valid user account can exploit this vulnerability by editing their profile and inserting a malicious script, such as ``, into the first or last name field [3]. The script is stored on the server and executed when any other user views the attacker's profile. No authentication beyond a standard user login is required, and the attack can be performed over the network [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, cookie theft, or other client-side attacks. The CVSS v3 score of 6.4 (Medium) reflects the need for user interaction and low privileges, but the potential for data exposure is significant [1].

Mitigation

As of the advisory publication, Forma LMS 2.3 is affected, and users are advised to upgrade to a patched version if available. The vendor's website indicates ongoing development and security improvements [2]. No official patch has been confirmed in the provided references, so administrators should apply input validation and output encoding as a workaround.