GitHub Advisory DatabaseGHSA-79XR-V794-WQ35MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
53.5%
A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| munkireport | munkireport | * | cpe:2.3:a:munkireport:munkireport:*:*:*:*:*:*:*:* |
| munkireport | managedinstalls | * | cpe:2.3:a:munkireport:managedinstalls:*:*:*:*:*:*:*:* |
References
github.com/advisories/GHSA-79xr-v794-wq35
github.com/munkireport/managedinstalls/commit/708f6a2abc4b80a3751bcc9cf896f80d84250c55
github.com/munkireport/managedinstalls/releases/tag/v2.6
github.com/munkireport/munkireport-php
github.com/munkireport/munkireport-php/releases/tag/v5.6.3
github.com/munkireport/munkireport-php/wiki/20200722-Reflected-XSS-In-Managedinstalls-Module
nvd.nist.gov/vuln/detail/CVE-2020-15883
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
53.5%