PT-2020-13087 · Testlink · Testlink

Published 2020-04-27 · Updated 2021-07-21 · CVE-2020-12274

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TestLink version 1.9.20

Description The issue arises from the goback url parameter in the lib/cfields/cfieldsExport.php file, which relies on client input and lacks proper constraints to lib/cfields/cfieldsView.php within the session's associated website.

Recommendations For TestLink version 1.9.20, consider restricting or validating the goback url parameter to prevent it from being manipulated by client input until a proper fix is available.

Fix

Related Identifiers

CVE-2020-12274

Affected Products

Testlink

References · 4

• https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/2d17cd00f981f8e8c97de34a12e368ba2a55e3d0 · Patch
• https://osv.dev/vulnerability/CVE-2020-12274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12274 · Security Note
• http://mantis.testlink.org/view.php?id=8894 · Note