Lucene search

TalosCVELIST:CVE-2020-13564

HistoryFeb 01, 2021 - 3:07 p.m.

CVE-2020-13564

2021-02-0115:07:44

CWE-80

talos

www.cve.org

cross-site scripting

phpgacl

arbitrary javascript execution

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.021

Percentile

89.4%

JSON

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.

CNA Affected

[
  {
    "product": "phpGACL",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "phpGACL 3.3.7"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2020-1177

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.021

Percentile

89.4%

JSON

Related for CVELIST:CVE-2020-13564