Medium severity · published Jul 8, 2020
CVE-2020-15073
An issue was discovered in phpList through 3.5.4
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phplist · Phplist
through 3.5.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15073
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15073
Exploit
https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html
Release Notes
https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377
Release Notes
https://www.phplist.org/newslist/phplist-3-5-5-release-notes/
More from Phplist
9.8
CVE-2017-20032
A vulnerability was found in PHPList 3.2.6
9.8
CVE-2017-20029
A vulnerability was found in PHPList 3.2.6 and classified as critical
9.8
CVE-2020-22249
Remote Code Execution vulnerability in phplist 3.5.1
9.8
CVE-2020-23361
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively…
9.8
CVE-2021-3188
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports