CVE-2020-9439: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php, tcfiltergroup parameter in reporting-admin-menu.php, tcfilteruser parameter in reporting-admin-menu.php, tcfiltercourse parameter in reporting-admin-menu.php, tcfilterlesson parameter in reporting-admin-menu.php, tcfiltermodule parameter in reporting-admin-menu.php, tcfilteraction parameter in reporting-admin-menu.php, tcfilterdatarange parameter in reporting-admin-menu.php, or tcfilterdatarangelast parameter in reporting-admin-menu.php.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-9439?
CVE-2020-9439 is a vulnerability that allows authenticated remote attackers to inject arbitrary web script or HTML via certain parameters in Uncanny Owl Tin Canny LearnDash Reporting before version 3.4.4.
What is the severity of CVE-2020-9439?
CVE-2020-9439 has a severity rating of 6.1 (medium).
Which software is affected by CVE-2020-9439?
Uncanny Owl Tin Canny LearnDash Reporting versions up to and excluding 3.4.4 are affected by CVE-2020-9439.
How can the arbitrary script or HTML injection be performed in CVE-2020-9439?
The arbitrary script or HTML injection can be performed by an authenticated remote attacker via the search_key GET parameter in TinCan_Content_List_Table.php, message GET parameter in licensing.php, and tc_file GET parameter in upload.php.
Are there any references related to CVE-2020-9439?
Yes, you can find more information about CVE-2020-9439 at the following references: [link1] [link2].