CVE-2020-13563: XSS

Published Feb 1, 2021

Updated

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template groupid parameter.

Affected Software

2 affected components

Phpgacl Project Phpgacl=3.3.7

open-emr Openemr=5.0.2

Event History

Feb 1, 2021

CVE Published

via MITRE·03:06 PM

Data Sourced

via MITRE·03:06 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-13563?

The severity of CVE-2020-13563 is critical with a CVSS score of 6.1.

What is the description of CVE-2020-13563?

CVE-2020-13563 is a cross-site scripting vulnerability that exists in the template functionality of phpGACL 3.3.7, allowing arbitrary JavaScript execution through a specially crafted HTTP request.

Which software versions are affected by CVE-2020-13563?

CVE-2020-13563 affects phpGACL version 3.3.7 and Open-emr version 5.0.2.

How can an attacker exploit CVE-2020-13563?

An attacker can exploit CVE-2020-13563 by providing a crafted URL with a malicious payload in the phpGACL template group_id parameter.

Is there a reference for CVE-2020-13563?

Yes, you can find more information about CVE-2020-13563 at the following link: [https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177](https://talosintelligence.com/vulnerability_reports/TALOS-2020-1177).