GHSA-79xr-v794-wq35

MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15883

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	munkireport/managedinstalls	< 2.6	2.6

Details

As written in the advisory (Markdown source, shown as plain text).

A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-15883 advisory
https://github.com/munkireport/managedinstalls/commit/708f6a2abc4b80a3751bcc9cf896f80d84250c55 web
https://github.com/munkireport/managedinstalls package
https://github.com/munkireport/managedinstalls/releases/tag/v2.6 web
https://github.com/munkireport/munkireport-php web
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 web
https://github.com/munkireport/munkireport-php/wiki/20200722-Reflected-XSS-In-Managedinstalls-Module web