Vulnerability Description
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rosariosis | Rosariosis | 6.7.2 |
Related Weaknesses (CWE)
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/184943VDB Entry
- https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdRelease NotesThird Party Advisory
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aaPatchThird Party Advisory
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/291Broken Link
- https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-betaThird Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/184943VDB Entry
- https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.mdRelease NotesThird Party Advisory
- https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aaPatchThird Party Advisory
- https://gitlab.com/francoisjacquet/rosariosis/-/issues/291Broken Link
- https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-betaThird Party Advisory
FAQ
What is CVE-2020-15717?
CVE-2020-15717 is a vulnerability with a CVSS score of 6.1 (MEDIUM). RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced paramete...
How severe is CVE-2020-15717?
CVE-2020-15717 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15717?
Check the references section above for vendor advisories and patch information. Affected products include: Rosariosis Rosariosis.