CVE-2020-15943

Katalog CVE

CVSS 8.1 · High EPSS 2,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada gantt-chart project gantt-chart. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check, it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability, an attacker has to be authenticated.

Rincian

Terbit di NVD

4 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-862: Missing Authorization

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/158751/Gantt-Chart-For-Jira-5.5.3-Missing-Privilege-Check.html exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Aug/0 exploit · mailing list · advisory pihak ketiga
• https://marketplace.atlassian.com/apps/28997/gantt-chart-for-jira?hosting=cloud&tab=overview product · advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-029.txt exploit · advisory pihak ketiga