Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10

CVE-2020-13893

[Suggested description]
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage
EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary
web script or HTML via multiple parameters through Unicode
Transformations (Best-fit Mapping), as demonstrated by the full-width
variants of the less-than sign (%EF%BC%9C) and greater-than sign
(%EF%BC%9E).

------------------------------------------

[Vulnerability Type]
Cross Site Scripting (XSS)

------------------------------------------

[Vendor of Product]
SAGE

------------------------------------------

[Affected Product Code Base]
EasyPay - 10.7.5.10

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Escalation of Privileges]
true

------------------------------------------

[Attack Vectors]
To exploit vulnerability, an authenticated attacker can inject
JavaScript into input fields with full-width variant of the
lesser-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E) to
bypass security measures in place.

------------------------------------------

[Reference]
https://www.sage.com/en-sg/products/sage-easypay/