CVE-2020-12274

2020-04-2712:34:54

mitre

www.cve.org

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.7%

JSON

In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk because it depends on client input and is not constrained to lib/cfields/cfieldsView.php at the web site associated with the session.

References

mantis.testlink.org/view.php?id=8894

github.com/TestLinkOpenSourceTRMS/testlink-code/commit/2d17cd00f981f8e8c97de34a12e368ba2a55e3d0