PT-2020-14317 · Grocy · Grocy

Muffyhub · Published 2020-02-05 · Updated 2022-10-18 · CVE-2020-15253

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Grocy versions <= 2.7.1

Description The issue is related to Cross-Site Scripting that can be exploited via the Create Shopping List module when it is deleted. This problem is also present in other modules, including users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes, and products. To exploit this issue, authentication is required, and it is recommended that Grocy not be publicly exposed.

Recommendations For Grocy versions <= 2.7.1, update to a version higher than 2.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the Create Shopping List module and other affected modules until a patch is available. Additionally, ensure that Grocy is not publicly exposed to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01158

CVE-2020-15253

GHSA-7F37-2FJR-V9P7

Affected Products

Grocy

References · 9

• 🔥 https://github.com/grocy/grocy/issues/996 · Exploit
• 🔥 https://exploit-db.com/exploits/48792 · Exploit
• https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887 · Patch
• https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772 · Patch
• https://bdu.fstec.ru/vul/2020-01158 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-15253 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15253 · Vendor Advisory
• https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190205-dnac-xss · Note