PT-2020-16681 · Yourls · Yourls Admin Panel

John2020 + 1 · Published 2020-10-23 · Updated 2022-05-24 · CVE-2020-27388

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions YOURLS Admin Panel versions 1.5 through 1.7.10

Description Multiple Stored Cross Site Scripting (XSS) issues exist due to the ability of an authenticated user to modify a PHP plugin with a malicious payload and upload it. This results in multiple stored XSS issues.

Recommendations For YOURLS Admin Panel versions 1.5 through 1.7.10, consider disabling the plugin upload feature until a patch is available to prevent exploitation of the stored XSS vulnerabilities. Restrict access to the admin panel to minimize the risk of authenticated users uploading malicious plugins.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-27388

GHSA-PWGG-R6FQ-MF94

Affected Products

Yourls Admin Panel

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-27388 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27388 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pwgg-r6fq-mf94 · Vendor Advisory
• https://github.com/YOURLS/YOURLS/pull/2761 · Note
• https://github.com/YOURLS/YOURLS/pull/2761/commits/93396c14587ece4f3d7bcb654f6d22eb0bae7d74 · Note
• https://github.com/YOURLS/YOURLS/commit/04495e8b17ffeedb695ef5a64389f6bee15d57fb · Note
• https://github.com/YOURLS/YOURLS · Note
• http://yourls.com · Note
• https://t.me/cibsecurity/15569 · Telegram Post
• https://johnjhacking.com/blog/cve-2020-27388 · Note
• https://t.me/cibsecurity/15570 · Telegram Post
• http://yourls.org · Note