CVE-2020-36844

KnowBe4 / Security Awareness Training PUBLISHED

Description (CNA)

The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL.

Affected (CNA)

Vendor / product	Versions
KnowBe4 / Security Awareness Training	affected 0 before 2020-01-10

CWE

CWE-79

References

https://www.doyler.net/security-not-included/knowbe4-vulnerabilities

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.