A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/, such that when the content is viewed (it can only be viewed by Administrators), attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2, Outsystems 11.9.0 Platform Server, and Outsystems 11.7.0 LifeTime Management Console.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:outsystems:lifetime_management_console:*:*:*:*:*:*:*:* | 11 to before 11.7.0 | Vulnerable | OutSystems |
| cpe:2.3:a:outsystems:outsystems:*:*:*:*:*:*:*:* | 10 to before 10.0.1005.2 | Vulnerable | OutSystems |
| cpe:2.3:a:outsystems:platform_server:*:*:*:*:*:*:*:* | 11 to before 11.9.0 | Vulnerable | OutSystems |
- cpe:2.3:a:outsystems:lifetime_management_console:*:*:*:*:*:*:*:* Versions 11 to before 11.7.0 Vulnerable ·OutSystems
- cpe:2.3:a:outsystems:outsystems:*:*:*:*:*:*:*:* Versions 10 to before 10.0.1005.2 Vulnerable ·OutSystems
- cpe:2.3:a:outsystems:platform_server:*:*:*:*:*:*:*:* Versions 11 to before 11.9.0 Vulnerable ·OutSystems
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13639
- 2026-10-03 Alias added: GHSA-f22p-xx2m-5g9m
References
More OutSystems Lifetime Management Console vulnerabilities
- TI-2021-10104 The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11… CVSS 3.1HIGH 8.6
Sources
- CVE-2020-13639 · CVE Program
- CVE-2020-13639 · NVD
- FIRST EPSS
- GHSA-f22p-xx2m-5g9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences