TI-2020-04759 Aliases CVE-2020-5838 GHSA-xwv4-ppgv-h9j7

Cross-site scripting in IT Analytics

LOW 23CWE-79Published 2020-05-13 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attackers to inject client-side scripts into web pages viewed by other users.

Why it matters now

EPSS 0.00689 52nd percentileScored 2026-11-07

Fix Fixed IT Analytics: 2.9.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	IT Analytics	before 2.9.1	2.9.1	Patch available	CNA

IT Analytics Vendor— Affected before 2.9.1 Fixed in 2.9.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:symantec:it_analytics::::::::	before 2.9.1	Vulnerable	Symantec

cpe:2.3:a:symantec:it_analytics:*:*:*:*:*:*:*:* Versions before 2.9.1 Vulnerable ·Symantec

Remediation

Fix · CNA IT Analytics Fixed in 2.9.1

Timeline

2026-10-02 Threatist record created from CVE-2020-5838
2026-10-03 Alias added: GHSA-xwv4-ppgv-h9j7

References

Advisory 1

https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1766

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences