Security readout for executives and security teams
Plain-English summary
Nozomi Guardian versions before 19.0.4 have a stored cross-site scripting issue in the web front end. An attacker who can create a custom field could use a crafted field name to store script content that later runs in a user's browser.
Executive priority
Treat as a targeted remediation item for teams using Nozomi Guardian. Prioritize upgrade if the platform is used in operational technology environments or if many users access the web interface.
Technical view
The vulnerability is stored XSS in Nozomi Guardian's web UI before 19.0.4. The cited description ties the issue to custom field creation and crafted field names. No CVSS, CWE, authentication requirement, or detailed impact chain is provided in the supplied sources.
Likely exposure
Exposure is limited to organizations running Nozomi Guardian before 19.0.4 where users or attackers can create custom fields in the web front end. Public internet exposure is not stated in the sources.
Exploitation context
The supplied bundle does not show active exploitation, and CISA KEV status is false. Public details identify the vulnerable input area but do not provide evidence of mass exploitation or weaponized tooling.
Researcher notes
Evidence is sparse: the bundle provides the affected version boundary and trigger area, but no CVSS, CWE, exploit prerequisites, or vendor technical write-up details. Avoid assuming unauthenticated access or broader product impact.
Mitigation direction
- Upgrade Nozomi Guardian to 19.0.4 or later.
- Review Nozomi and Deloitte guidance for supported remediation details.
- Limit access to the Guardian web front end to trusted users.
- Audit custom field names created before remediation.
- Monitor for unexpected script-like content in custom fields.
Validation and detection
- Inventory Nozomi Guardian deployments and record exact versions.
- Confirm all instances are version 19.0.4 or later.
- Review whether custom field creation is available to non-admin users.
- Inspect existing custom field names for suspicious content.
- Check web UI logs for unusual custom field activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-15307 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www2.deloitte.com/de/de/pages/risk/articles/nozomi-stored-xss.html?nc=1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.