MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability

MEDIO 6.1CVE-2020-15883 · GHSA-79xr-v794-wq35 · Published 23/07/2020 · updated 17/06/2026

En resumen

CVE-2020-15883 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a munkireport/managedinstalls, managedinstalls (managedinstalls project).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 67.4% de las vulnerabilidades.
Solución: actualizar a 2.6 o posterior.

Package	Affected versions	Patched versions
munkireport/managedinstalls Packagist	`< 2.6`	`2.6`
managedinstalls managedinstalls_project	`< 2.6`	`2.6`

Description

A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-15883 · ADVISORY
munkireport/managedinstalls commit 708f6a2 · WEB
munkireport/managedinstalls · PACKAGE
munkireport/managedinstalls release v2.6 · WEB
munkireport/munkireport-php · WEB
munkireport/munkireport-php release v5.6.3 · WEB
munkireport/munkireport-php · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

munkireport/managedinstalls

Packagist

< 2.6

2.6

managedinstalls

managedinstalls_project

< 2.6

2.6

Description

NVD description