CVE-2020-10192

Опубликовано: 09 мар. 2020

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php.

Ссылки

https://github.com/munkireport/munkireport-php/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerability
Exploit
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200309-XSS-vulnerability
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:munkireport_project:munkireport:*:*:*:*:*:*:*:*

Версия до 5.3.0 (исключая)

EPSS

Процентиль: 71%

0.00668

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-hgx7-g7w4-8845

github

больше 3 лет назад