Lucene search

VulDBCVE-2020-36828

HistoryMar 31, 2024 - 9:15 a.m.

CVE-2020-36828

2024-03-3109:15:10

CWE-79

VulDB

web.nvd.nist.gov

cross site scripting

remote attack

discuzx 3.4-20200818

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/install/include/install_function.php. The manipulation of the argument uchidden leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.4-20210119 is able to address this issue. The name of the patch is 4a9673624f46f7609486778ded9653733020c567. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258612.

Affected configurations

Vulners

Node

discuzdiscuzxMatch3.4-20200818

VendorProductVersionCPE
discuzdiscuzx3.4-20200818cpe:2.3:a:discuz:discuzx:3.4-20200818:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
discuz	discuzx	3.4-20200818	cpe:2.3:a:discuz:discuzx:3.4-20200818:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "DiscuzX",
    "versions": [
      {
        "version": "3.4-20200818",
        "status": "affected"
      }
    ]
  }
]

References

github.com/codersclub/DiscuzX/commit/4a9673624f46f7609486778ded9653733020c567

vuldb.com/?ctiid.258612

vuldb.com/?id.258612

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2020-36828