CVE-2020-12882

2020-05-1505:15:13

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.6%

JSON

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.

CPENameOperatorVersion
submittyeq0.1.1/0.1.1
submittyeq20.03.00
submittyeq0.2.1
submittyeq0.4.3
submittyeq.1.0.1
submittyeqpre_migration
submittyeq0.4.2.1
submittyeq19.10.00
submittyeq19.12.00
submittyeq20.03.01

Name	Operator	Version
submitty	eq	0.1.1/0.1.1
submitty	eq	20.03.00
submitty	eq	0.2.1
submitty	eq	0.4.3
submitty	eq	.1.0.1
submitty	eq	pre_migration
submitty	eq	0.4.2.1
submitty	eq	19.10.00
submitty	eq	19.12.00
submitty	eq	20.03.01