CVE-2020-13409

CVE-2020-13409 describes a reflected and stored Cross-Site Scripting (XSS) vulnerability in Tufin SecureTrack versions prior to R20-2 GA. This flaw allows an attacker to inject malicious scripts, which can be reflected back to the user and persistently stored in the database, potentially leading to repeated execution. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-adjacent attack vector, low attack complexity, and requiring user interaction, with potential impacts on confidentiality, integrity, and availability. While low-privileged users can inject XSS, an unauthenticated attacker could gain administrative access. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.