CVE-2020-13564: XSS
Published Feb 1, 2021
·Updated
A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template aclid parameter.
Affected Software
2 affected components
Phpgacl Project Phpgacl=3.3.7
open-emr Openemr=5.0.2
Event History
Feb 1, 2021
CVE Published
via MITRE·03:07 PM
Data Sourced
via MITRE·03:07 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-13564?
CVE-2020-13564 is a cross-site scripting vulnerability in the template functionality of phpGACL 3.3.7 and Open-emr 5.0.2.
2
How severe is CVE-2020-13564?
CVE-2020-13564 has a severity score of 6.1 (critical).
3
How does CVE-2020-13564 work?
CVE-2020-13564 can be exploited by a specially crafted HTTP request that leads to arbitrary JavaScript execution.
4
Which software is affected by CVE-2020-13564?
phpGACL 3.3.7 and Open-emr 5.0.2 are affected by CVE-2020-13564.
5
Is there a fix for CVE-2020-13564?
At the time of this report, no official fix has been released for CVE-2020-13564.