Security readout for executives and security teams
Plain-English summary
CVE-2020-18664 is a cross-site scripting issue reported in WebPort versions up to 1.19.1. A malicious connection name may be stored and later displayed as executable script. This could let an attacker affect users who view the vulnerable page, but the public record does not provide severity, CVSS, or confirmed exploitation.
Executive priority
Prioritize identification over emergency response. There is insufficient evidence for active exploitation or critical severity, but stored XSS in an administrative web tool can affect privileged users. Confirm whether WebPort is present, reduce access, and follow vendor guidance before accepting residual risk.
Technical view
The reported flaw is stored XSS in WebPort <=1.19.1 involving the connection name parameter in the access/setup/type-conn area. The source bundle does not include CPEs, CWE classification, CVSS scoring, authentication prerequisites, or a vendor-fixed version. Treat exposure analysis as product/version driven and verify against local deployments.
Likely exposure
Exposure is likely limited to organizations running WebPort <=1.19.1. Risk increases if the affected setup or connection-management interface is reachable by untrusted users. The CVE metadata lists affected vendor and product as n/a, so asset discovery must rely on local software inventory and WebPort version checks.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is described as stored XSS, meaning malicious input could persist and run when another user views it. The sources do not establish exploit maturity, attacker prerequisites, or observed campaigns.
Researcher notes
Public metadata is sparse. The record identifies the vulnerable parameter and version range but lacks CVSS, CWE, CPE, exploit status, and official remediation detail. Analysts should avoid over-scoring from the CVE alone and validate exposure directly against local WebPort instances and the referenced reports.
Mitigation direction
- Identify any WebPort deployments and confirm whether versions are <=1.19.1.
- Check WebPort maintainer or project guidance for fixed versions or official mitigations.
- Restrict WebPort setup and connection-management access to trusted administrators and networks.
- Review stored connection names and remove unexpected or suspicious entries.
- For maintained forks, ensure connection names are safely validated and output-encoded.
Validation and detection
- Confirm WebPort version information from deployed instances or package inventory.
- Review whether access/setup/type-conn pages are reachable by untrusted users.
- Inspect existing connection-name records for unexpected script-like content.
- Check logs for unusual changes to connection configuration names.
- Track remediation status until vendor guidance or an upgraded version is confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-18664 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/LoRexxar/CVE_Request/blob/master/web%20port%20mul%20vuls%20before%20v1.19.1/web%20port%20mul%20vuls%20before%20v1.19.1.md#stored-xss--in-accesssetuptype-connCVE reference · x_refsource_MISC
- https://www.seebug.org/vuldb/ssvid-97994CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.