Lucene search

GoogleOSV:GHSA-PWGG-R6FQ-MF94

HistoryMay 24, 2022 - 5:32 p.m.

YOURLS Stored Cross Site Scripting (XSS)

2022-05-2417:32:11

Google

osv.dev

yourls

stored cross site scripting

xss

admin panel

versions 1.5 - 1.7.10

authenticated user

php plugin

malicious payload

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

26.9%

JSON

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

References

yourls.org

github.com/YOURLS/YOURLS

github.com/YOURLS/YOURLS/commit/04495e8b17ffeedb695ef5a64389f6bee15d57fb

github.com/YOURLS/YOURLS/pull/2761

github.com/YOURLS/YOURLS/pull/2761/commits/93396c14587ece4f3d7bcb654f6d22eb0bae7d74

johnjhacking.com/blog/cve-2020-27388

nvd.nist.gov/vuln/detail/CVE-2020-27388