// For flags

CVE-2020-9439

 

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.

Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Uncanny Owl Tin Canny LearnDash Reporting versiones anteriores a 3.4.4, permite a atacantes remotos autenticados inyectar un script web o HTML arbitrario por medio del parámetro GET search_key en el archivo TinCan_Content_List_Table.php, un mensaje del Parámetro GET en el archivo licensing.php, parámetro tc_filter_group en el archivo reporting-admin-menu.php, parámetro tc_filter_user en el archivo reporting-admin-menu.php, parámetro tc_filter_course en el archivo reporting-admin-menu.php, parámetro tc_filter_lesson en el archivo reporting-admin-menu.php, parámetro tc_filter_module en el archivo reporting-admin- menu.php, parámetro tc_filter_action en el archivo reporting-admin-menu.php, parámetro tc_filter_data_range en el archivo reporting-admin-menu.php, o parámetro tc_filter_data_range_last en el archivo reporting-admin-menu.php

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-02-27 CVE Reserved
  • 2020-12-23 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Uncannyowl
Search vendor "Uncannyowl"
 Tin Canny Reporting For Learndash
Search vendor "Uncannyowl" for product "Tin Canny Reporting For Learndash"
 < 3.4.4
Search vendor "Uncannyowl" for product "Tin Canny Reporting For Learndash" and version " < 3.4.4"
-
Affected