Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote…
Priority LOW 30CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs.
Why it matters now
EPSS 0.01244 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:safe:fme_server:2019.0:*:*:*:*:*:*:* | 2019.0 | Vulnerable | Safe |
| cpe:2.3:a:safe:fme_server:2019.1:*:*:*:*:*:*:* | 2019.1 | Vulnerable | Safe |
| cpe:2.3:a:safe:fme_server:2019.2:beta:*:*:*:*:*:* | 2019.2 beta | Vulnerable | Safe |
| cpe:2.3:a:safe:fme_server:2020.0:beta:*:*:*:*:*:* | 2020.0 beta | Vulnerable | Safe |
- cpe:2.3:a:safe:fme_server:2019.0:*:*:*:*:*:*:* Versions 2019.0 Vulnerable ·Safe
- cpe:2.3:a:safe:fme_server:2019.1:*:*:*:*:*:*:* Versions 2019.1 Vulnerable ·Safe
- cpe:2.3:a:safe:fme_server:2019.2:beta:*:*:*:*:*:* Versions 2019.2 beta Vulnerable ·Safe
- cpe:2.3:a:safe:fme_server:2020.0:beta:*:*:*:*:*:* Versions 2020.0 beta Vulnerable ·Safe
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-22789
- 2026-10-03 Alias added: GHSA-gfxh-gvwh-3w55
References
More Safe Fme Server vulnerabilities
- TI-2022-17982 Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a… CVSS 3.1CRITICAL 9.1
- TI-2022-17981 Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting… CVSS 3.1CRITICAL 9.6
- TI-2023-17889 A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an… CVSS 3.1HIGH 8.1
- TI-2018-14455 Safe Software FME Server through 2018.1 creates and enables three additional accounts in… CVSS 3.0HIGH 8.8
- TI-2022-17984 Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML… CVSS 3.1HIGH 8.5
- TI-2022-17983 Safe Software FME Server v2021.2.5 and below does not employ server-side validation. CVSS 3.1HIGH 7.1
Sources
- CVE-2020-22789 · CVE Program
- CVE-2020-22789 · NVD
- FIRST EPSS
- GHSA-gfxh-gvwh-3w55 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences