CVE-2020-13980: 
PHP vulnerability analysis and mitigation

CVE-2020-13980 is a disputed cross-site scripting (XSS) vulnerability affecting OpenCart version 3.0.3.3. The vulnerability allows remote authenticated users to conduct XSS attacks through a crafted filename in the users' image upload section due to insufficient entity encoding. This issue emerged as a result of an incomplete fix for CVE-2020-10596 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue stems from inadequate entity encoding in the image upload functionality, specifically in the users' section. The vulnerability requires high privileges (authenticated access to admin) and user interaction to be exploited (NVD).

The potential impact of this vulnerability is limited due to the requirement of administrative access. If exploited, it could allow authenticated users to execute cross-site scripting attacks through specially crafted filenames in the image upload section (NVD).

The exploitability of this vulnerability is considered relatively low due to the requirement of administrative access. The vendor has disputed the severity of the issue, stating 'this is not a massive issue as you are still required to be logged into the admin' (NVD).

No official patch has been released as the vendor has disputed the severity of the vulnerability. The primary mitigation is the requirement of administrative access, which naturally limits the potential attack surface (NVD).