PT-2021-9636 · Phpgacl · Phpgacl

Claudio Bozzato · Published 2021-01-30 · Updated 2022-06-29 · CVE-2020-13562

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpGACL version 3.3.7

Description A cross-site scripting issue exists in the template functionality. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this issue in the action parameter of the phpGACL template.

Recommendations For phpGACL version 3.3.7, consider disabling the template functionality until a patch is available. Restrict access to the template action parameter to minimize the risk of exploitation. Avoid using the action parameter in the affected template endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2020-13562

Affected Products

Phpgacl

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13562 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13562 · Vendor Advisory
• https://t.me/cibsecurity/22900 · Telegram Post
• https://t.me/cybersecuritytechnologies/2599 · Telegram Post