PT-2020-13892 · Kumbiaphp · Kumbiaphp

Jenaye · Published 2020-06-15 · Updated 2022-05-24 · CVE-2020-14146

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KumbiaPHP versions 1.1.1 and earlier

Description The issue allows for XSS via the "public/pages/kumbia" PATH INFO, specifically when KumbiaPHP is in Development mode.

Recommendations For versions 1.1.1 and earlier, consider disabling Development mode to mitigate the risk of exploitation. Restrict access to the "public/pages/kumbia" PATH INFO to minimize the risk of XSS attacks. Avoid using the PATH INFO variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14146

GHSA-X6GQ-VR59-4Q5Q

Affected Products

Kumbiaphp

References · 7

• 🔥 https://github.com/jenaye/KumbiaPHP- · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14146 · Security Note
• https://osv.dev/vulnerability/GHSA-x6gq-vr59-4q5q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14146 · Vendor Advisory
• https://github.com/KumbiaPHP/KumbiaPHP/releases · Note
• https://github.com/KumbiaPHP/kumbiapp · Note
• https://t.me/cvenotify/4364 · Telegram Post