Vulnerability Details : CVE-2020-15253
Potential exploit
Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2020-15253
- cpe:2.3:a:grocy:grocy:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-15253
0.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 58 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-15253
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST | |
|
4.8
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
1.7
|
2.7
|
NIST | |
|
7.3
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N |
1.0
|
5.8
|
GitHub, Inc. |
CWE ids for CVE-2020-15253
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: security-advisories@github.com (Primary)
References for CVE-2020-15253
-
https://www.exploit-db.com/exploits/48792
grocy 2.7.1 - Persistent Cross-Site Scripting - PHP webapps ExploitExploit;Third Party Advisory;VDB Entry
-
https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7
XSS and HTML injection possible at some places · Advisory · grocy/grocy · GitHubThird Party Advisory
-
https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887
Excape HTML (where needed, for bootbox) (references #996) · grocy/grocy@0df2590 · GitHubPatch;Third Party Advisory
-
https://github.com/grocy/grocy/issues/996
XSS and HTML Injection on Create Shopping List & shopping list item notes (Rendered upon deleting it) · Issue #996 · grocy/grocy · GitHubExploit;Issue Tracking;Third Party Advisory
-
https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772
Excape shopping list item notes (references #996) · grocy/grocy@0624b0d · GitHubPatch;Third Party Advisory
Jump to