CVE-2020-15717 - Vulnerability Details - OpenCVE

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00827.

Key SSVC decision points have not yet been added.

Vendors	Products
Rosariosis	Rosariosis

Configuration 1 [-]

cpe:2.3:a:rosariosis:rosariosis:6.7.2:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2020-7703	RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/184943
https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md
https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a
https://gitlab.com/francoisjacquet/rosariosis/-/issues/291
https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-07-15T19:01:43

Updated: 2024-08-04T13:22:30.760Z

Reserved: 2020-07-14T00:00:00

Link: CVE-2020-15717

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-07-15T19:15:12.243

Modified: 2024-11-21T05:06:05.597

Link: CVE-2020-15717

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-07-15T19:01:43", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md"}, {"tags": ["x_refsource_MISC"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291"}, {"tags": ["x_refsource_MISC"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta"}, {"tags": ["x_refsource_MISC"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-15717", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md", "refsource": "MISC", "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md"}, {"name": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291", "refsource": "MISC", "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291"}, {"name": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta", "refsource": "MISC", "url": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta"}, {"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943", "refsource": "MISC", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943"}, {"name": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a", "refsource": "CONFIRM", "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:22:30.760Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-15717", "datePublished": "2020-07-15T19:01:43", "dateReserved": "2020-07-14T00:00:00", "dateUpdated": "2024-08-04T13:22:30.760Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rosariosis:rosariosis:6.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "4A870F8E-3082-421C-A701-75D43DD6276C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL."}, {"lang": "es", "value": "RosarioSIS versi\u00f3n 6.7.2, es vulnerable a un ataque de tipo XSS, causado por una comprobaci\u00f3n inapropiada de la entrada suministrada por el usuario mediante el script Search.inc.php. Un atacante remoto podr\u00eda explotar esta vulnerabilidad usando el par\u00e1metro advanced en una URL dise\u00f1ada"}], "id": "CVE-2020-15717", "lastModified": "2024-11-21T05:06:05.597", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-07-15T19:15:12.243", "references": [{"source": "cve@mitre.org", "tags": ["VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/184943"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/mobile/CHANGES.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/89ae9de732024e3a2e99262aa98b400a1aa6975a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/291"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gitlab.com/francoisjacquet/rosariosis/-/tags/v6.8-beta"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}