CVE-2020-12882
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack...
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- Record
CVE-2020-12882- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- Record
CVE-2020-12882- Updated
- 2026-11-02
EUVDEUVD-2020-5163 No score
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- Record
EUVD-2020-5163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2cpf-r6vv-ph3v No score
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack...
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- Record
GHSA-2cpf-r6vv-ph3v- Updated
- 2026-11-02
OSV
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
- Record
CVE-2020-12882- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Submitty 20.04.01 - Persistent Cross-Site Scripting | 2020-05-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-12882 is a medium vulnerability (CVSS 5.4) in Rcos Submitty, published May 15, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. No source names a fixed version.