Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Uncannyowl | Tin Canny Reporting For Learndash | < 3.4.4 |
Related Weaknesses (CWE)
References
- https://gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5Third Party Advisory
- https://www.uncannyowl.com/knowledge-base/tin-canny-learndash-reporting-changeloRelease NotesVendor Advisory
- https://gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5Third Party Advisory
- https://www.uncannyowl.com/knowledge-base/tin-canny-learndash-reporting-changeloRelease NotesVendor Advisory
FAQ
What is CVE-2020-9439?
CVE-2020-9439 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searc...
How severe is CVE-2020-9439?
CVE-2020-9439 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-9439?
Check the references section above for vendor advisories and patch information. Affected products include: Uncannyowl Tin Canny Reporting For Learndash.