LiveActive security incident?Get immediate response
CVE Record

CVE-2020-28502: Arbitrary Code Injection

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

HighCVSS 8.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takehigh

Analyst readout for executives and security teams

Plain-English summary

This is a high-impact dependency issue in Node XMLHttpRequest-style packages. If an application sends attacker-controlled input through a synchronous XMLHttpRequest path, injected code may run. The business risk is concentrated in applications that directly use or bundle these packages, not every JavaScript application.

Executive priority

Prioritize remediation for internet-facing services or build artifacts that include these packages. The issue has high confidentiality, integrity, and availability impact, but exposure is dependency- and code-path-specific, so inventory should come first.

Technical view

CVE-2020-28502 affects xmlhttprequest before 1.7.0 and all listed versions of xmlhttprequest-ssl. The described sink is xhr.send when xhr.open uses synchronous mode. CVSS 3.1 is 8.1 with network attack vector, no privileges, no user interaction, high impact, and high attack complexity.

Likely exposure

Likely exposure is in server-side JavaScript or bundled WebJars that include xmlhttprequest below 1.7.0 or xmlhttprequest-ssl. Highest concern is code that uses synchronous requests and passes user-controlled data into xhr.send.

Exploitation context

The provided bundle does not show CISA KEV listing or confirmed active exploitation. CVSS records proof-of-concept exploit maturity, high attack complexity, and no required authentication or user interaction. Practical exploitation depends on a reachable synchronous request path with attacker-controlled input.

Researcher notes

The strongest evidence is the CVE description and Snyk references. The bundle names affected package ranges but does not provide detailed exploit telemetry, a CWE, or a fixed version for xmlhttprequest-ssl. Do not assume active exploitation from the supplied sources.

Mitigation direction

  • Upgrade xmlhttprequest to version 1.7.0 or later where used.
  • Treat xmlhttprequest-ssl as unresolved in this bundle; check vendor guidance or replace it.
  • Remove unused transitive copies from applications and packaged WebJars.
  • Avoid synchronous XMLHttpRequest paths that process untrusted input.
  • Validate and constrain data before it reaches xhr.send.

Validation and detection

  • Inventory package manifests, lockfiles, and SBOMs for xmlhttprequest and xmlhttprequest-ssl.
  • Confirm xmlhttprequest versions are 1.7.0 or later.
  • Flag any remaining xmlhttprequest-ssl dependency for replacement or vendor review.
  • Review code for synchronous xhr.open usage and user-controlled xhr.send data.
  • Check whether vulnerable packages are bundled in deployed artifacts.
Prepared
Confidence
medium
Sources
7

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-28502 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C2.25.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.1High
CVSS 3.1 vector shape for CVE-2020-28502Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/axmlhttprequestunspecifiedListed
n/axmlhttprequest-ssl0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.