CVE-2020-15253

Katalog CVE

CVSS 4.8 · Medium EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada grocy. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.

Rincian

Terbit di NVD

14 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772 patch · advisory pihak ketiga
• https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887 patch · advisory pihak ketiga
• https://github.com/grocy/grocy/issues/996 exploit · issue tracking · advisory pihak ketiga
• https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7 advisory pihak ketiga
• https://www.exploit-db.com/exploits/48792 exploit · advisory pihak ketiga · vdb entry