CVE-2020-9439

MITTEL 6.1CVE-2020-9439 · Published 23/12/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-9439 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in tin canny reporting for learndash (uncannyowl).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.78%, höher als bei 56.0% aller Schwachstellen.
Abhilfe: auf 3.4.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
tin canny reporting for learndash uncannyowl	`< 3.4.4`	`3.4.4`

Description

Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.

References

gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5 · Third Party Advisory
uncannyowl.com/knowledge-base/tin-canny-learndash-reporting-changelog · Release Notes

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free