CVE-2020-19587

5.4 mediumEPSS 0.9%

Medium (5.4) in idera yellowfin business intelligence. EPSS 0.9% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbitrary code via MIAdminStyles.i4 Admin UI.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-09-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

idera:yellowfin_business_intelligence

References

https://github.com/Deepak983/CVE-2020-19587/blob/main/_Stored%20XSS%20in%20MIAdminStyles.i4%20through%20privileges%20escalation.pdf
https://www.linkedin.com/in/deepak-sharma-72a044b4/
https://github.com/Deepak983/CVE-2020-19587/blob/main/_Stored%20XSS%20in%20MIAdminStyles.i4%20through%20privileges%20escalation.pdf
https://www.linkedin.com/in/deepak-sharma-72a044b4/

Check your stack JSON