CVE-2020-15253: Stored XSS in Grocy
First published: Wed Oct 14 2020(Updated: )
Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grocy | <=2.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772
- https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887
- https://github.com/grocy/grocy/issues/996
- https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7
- https://www.exploit-db.com/exploits/48792
Frequently Asked Questions
What is the severity of CVE-2020-15253?
CVE-2020-15253 has a moderate severity rating due to its potential for Cross-Site Scripting vulnerabilities.
How do I fix CVE-2020-15253?
To fix CVE-2020-15253, upgrade to Grocy version 2.7.2 or later where the vulnerability has been addressed.
What versions of Grocy are affected by CVE-2020-15253?
CVE-2020-15253 affects all versions of Grocy up to and including 2.7.1.
What type of vulnerability is CVE-2020-15253 classified as?
CVE-2020-15253 is classified as a Cross-Site Scripting (XSS) vulnerability.
Can CVE-2020-15253 affect user data?
Yes, CVE-2020-15253 could potentially lead to unauthorized access or leakage of user data through XSS attacks.
- agent/softwarecombine
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/grocy
- canonical/grocy
- version/grocy/2.7.1