silverstripe-advancedreports vulnerable to XSS

보통 6.1CVE-2020-25102 · GHSA-8f2x-hv9r-mh9r · Published 03/09/2020 · updated 17/06/2026

요약

CVE-2020-25102은(는) silverstripe-australia/advancedreports, advanced reports (advanced reports project)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.91%, 전체 취약점의 60.2%보다 높음.
아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package	Affected versions	Patched versions
silverstripe-australia/advancedreports Packagist	`≥ 1.0, ≤ 2.0`	No fix yet
advanced reports advanced_reports_project	`≥ 1.0, ≤ 2.0`	No fix yet

Description

silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter.

NVD description

silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter.

References

nvd.nist.gov/vuln/detail/CVE-2020-25102 · ADVISORY
gist.github.com/ahpaleus/c3bd2d41d306544ca3158569335d12f2 · WEB
nyeholt/silverstripe-advancedreports · PACKAGE
nyeholt/silverstripe-advancedreports release · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

요약

CVE-2020-25102은(는) silverstripe-australia/advancedreports, advanced reports (advanced reports project)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.

향후 30일 내 악용 확률(EPSS): 0.91%, 전체 취약점의 60.2%보다 높음.

아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.

Package

Affected versions

Patched versions

silverstripe-australia/advancedreports

Packagist

≥ 1.0, ≤ 2.0

No fix yet

advanced reports

advanced_reports_project

≥ 1.0, ≤ 2.0

No fix yet

Description

NVD description

silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item (aka report preview) when an SVG document is provided in the Description parameter.