Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1wd2dnLXI2ZnEtbWY5NM4AAmZg

YOURLS Stored Cross Site Scripting (XSS)

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

Permalink: https://github.com/advisories/GHSA-pwgg-r6fq-mf94
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wd2dnLXI2ZnEtbWY5NM4AAmZg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-pwgg-r6fq-mf94, CVE-2020-27388
References:

Repository: https://github.com/YOURLS/YOURLS
Blast Radius: 3.8

Affected Packages

packagist:yourls/yourls

Dependent packages: 0
Dependent repositories: 5
Downloads: 24,994 total
Affected Version Ranges: >= 1.5, < 1.8
Fixed in: 1.8
All affected versions: 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.9
All unaffected versions: 1.8.1, 1.8.2, 1.9.1, 1.9.2