Description

Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Rukovoditel 2.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to /rukovoditel_2.4.1/index.php?module=configuration/save&redirect_to=configuration/application.

Remediation

References

CVE-2020-18469

Related Vulnerabilities

Swagger UI DOM XSS vulnerability

WordPress Plugin Integrator 'redirect_to' Parameter Cross-Site Scripting (1.32)

Apache HTTP Server Off-by-one Error Vulnerability (CVE-2005-1268)

WordPress 4.6.x Prototype Pollution (4.6 - 4.6.22)

MySQL CVE-2018-2816 Vulnerability (CVE-2018-2816)

Severity

Medium

Classification

CVE-2020-18469 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities