CVE-2020-26166

Опубликовано: 05 окт. 2020

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.

Ссылки

http://qdpm.net/qdpm-release-notes-free-project-management
Release Notes
Vendor Advisory
https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md
Third Party Advisory
https://sourceforge.net/projects/qdpm/
Product
Third Party Advisory
http://qdpm.net/qdpm-release-notes-free-project-management
Release Notes
Vendor Advisory
https://github.com/Kajmer/CVEs/blob/main/CVE-2020-26166.md
Third Party Advisory
https://sourceforge.net/projects/qdpm/
Product
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:qdpm:qdpm:9.1:*:*:*:*:*:*:*

EPSS

Процентиль: 49%

0.00261

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-m583-fc3c-p6gh

github

больше 3 лет назад