CVE-2020-26713

Опубликовано: 12 янв. 2021

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.

Ссылки

https://github.com/vuongdq54/RedCap
Exploit
Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Release Notes
Vendor Advisory
https://www.project-redcap.org/
Product
Vendor Advisory
https://github.com/vuongdq54/RedCap
Exploit
Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Release Notes
Vendor Advisory
https://www.project-redcap.org/
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:vanderbilt:redcap:10.0.20:*:*:*:lts:*:*:*

cpe:2.3:a:vanderbilt:redcap:10.3.4:*:*:*:-:*:*:*

EPSS

Процентиль: 60%

0.00397

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-g6h9-mmp2-jjh2

github

больше 3 лет назад