CVE-2020-15885

Опубликовано: 23 июл. 2020

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.

Ссылки

https://github.com/munkireport/comment/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200722--XSS-Filter-Bypass-On-Comments
Third Party Advisory
https://github.com/munkireport/comment/releases
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php
Third Party Advisory
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
Release Notes
Third Party Advisory
https://github.com/munkireport/munkireport-php/wiki/20200722--XSS-Filter-Bypass-On-Comments
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:munkireport_project:comment:*:*:*:*:*:munkireport:*:*

Версия до 4.0 (исключая)

EPSS

Процентиль: 50%

0.0027

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vc4f-2g7f-pmqr