PT-2020-20660 · Uncanny Owl · Uncanny Owl Tin Canny Learndash Reporting

Michael Ritter · Published 2020-12-23 · Updated 2020-12-23 · CVE-2020-9439

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Uncanny Owl Tin Canny LearnDash Reporting versions prior to 3.4.4

Description The issue allows authenticated remote attackers to inject arbitrary web script or HTML via several parameters, including the search key GET parameter in TinCan Content List Table.php, message GET parameter in licensing.php, and multiple tc filter parameters in reporting-admin-menu.php. These parameters include tc filter group, tc filter user, tc filter course, tc filter lesson, tc filter module, tc filter action, tc filter data range, and tc filter data range last.

Recommendations For versions prior to 3.4.4, update to version 3.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected parameters, such as search key, message, and the tc filter parameters, until a patch is applied. Avoid using these parameters in the affected API endpoints, specifically in TinCan Content List Table.php and licensing.php, until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-9439

Affected Products

Uncanny Owl Tin Canny Learndash Reporting

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-9439 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9439 · Vendor Advisory
• https://uncannyowl.com/knowledge-base/tin-canny-learndash-reporting-changelog · Vendor Advisory
• https://gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5 · Note
• https://t.me/cibsecurity/21223 · Telegram Post