CVE-2020-15716: RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script

Medium severity · published Jul 15, 2020

CVE-2020-15716

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script

6.1

CVSS

5.6%

EPSS

On KEV

Description

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)5.6% · higher than 93% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Rosariosis · Rosariosis

6.7.2 · source: NVD

Affected product

Rosariosis

All Rosariosis CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-15716

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-15716

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/184942

github.com

https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-15716.md

Release Notes

https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md

Patch

https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a

Broken Link

https://gitlab.com/francoisjacquet/rosariosis/-/issues/291

Third Party Advisory

https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta