CVE-2020-18469

Опубликовано: 26 авг. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to /rukovoditel_2.4.1/index.php?module=configuration/save&redirect_to=configuration/application.

Ссылки

https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3
Exploit
Issue Tracking
Third Party Advisory
https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/5
Exploit
Issue Tracking
Third Party Advisory
https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/3
Exploit
Issue Tracking
Third Party Advisory
https://github.com/joelister/Persistent-XSS-on-qdPM-9.1/issues/5
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:rukovoditel:rukovoditel:2.4.1:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00114

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-5x8r-x7fw-hf3f

github

больше 3 лет назад