GHSA-x9q4-5f3c-cw62

MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-15881

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	munkireport/munki_facts	< 1.5	1.5

Details

As written in the advisory (Markdown source, shown as plain text).

A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-15881 advisory
https://github.com/munkireport/munki_facts package
https://github.com/munkireport/munki_facts/releases web
https://github.com/munkireport/munkireport-php web
https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 web
https://github.com/munkireport/munkireport-php/wiki/20200722-munki_facts-XSS web