A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fie…

published 2020-01-30 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29359

cvss: 6.9; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 1; Exploit-DB

A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message, Banner Message, and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.

Patch / fix

fixed in 1

kronos web_time_and_attendance 4.0

Timeline

2020-01-30 Published
2020-02-05 First public exploit (EDB-48001)

Exploit prediction

1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-48001 Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation webapps, 2020-02-05
nolanbkennedy.com http://www.nolanbkennedy.com/post/stored-xss-in-kronos-web-time-and-attendance-webta referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.9	CVSS:3.0/AC:L/AV:N/A:N/C:L/I:H/PR:H/S:C/UI:R
NVD	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CNA	3.0	6.9	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

nolanbkennedy.com /post/stored-xss-in-kronos-web-time-and-attendance-webta
exploit, third-party-advisory
packetstormsecurity.com /files/156215/Kronos-WebTA-4.0-Privilege-Escalation-Cross-Site-Scripting.html
exploit, third-party-advisory
kronos.com /products/kronos-webta
product, vendor-advisory

Sources

CVE List CVE-2020-8493
NVD CVE-2020-8493

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary