CVE-2020-25071: Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project

Routine

MEDIUM 5.4DOWNGRADE

CVE-2020-25071 is a medium-severity flaw (CVSS 5.4) affecting nifty. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.7% (top 48%)
CISA exploited list	No
Weakness	CWE-79
Published	2020-09-15
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: niftypm

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-09-15 18:15 UTCPublished CVE record published
2026-06-17 03:06 UTCUpdated Record last modified

niftypm nifty DOWNGRADE

Affected: 2020-08-26

Fixed in: no fixed release known

Safe to downgrade to: a release before 2020-08-26

1. Check installed version

apt-cache policy nifty || rpm -q nifty || nifty --version

2. No fixed release: DOWNGRADE to a release before 2020-08-26 (Debian / Ubuntu)

apt-cache madison nifty sudo apt install nifty=<VERSION_BEFORE_2020-08-26> sudo apt-mark hold nifty

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list nifty sudo dnf downgrade nifty-<VERSION_BEFORE_2020-08-26> sudo dnf versionlock add nifty

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-25071?

nifty: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-25071 being exploited?

CVE-2020-25071 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-25071 affect?

CVE-2020-25071 affects nifty. Severity is medium (CVSS 5.4). Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an

How urgent is CVE-2020-25071?

Priority 32/100. No elevated risk signals yet.

References

← Back to latest CVEs