GitHub Advisoryadvisory · Packagist

GHSA-589w-hccm-265x Inline attribute values were not processed.

HIGH Published 2020-10-19 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-15263
Ecosystem
Packagist
Packages
orchid/platform
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2020-10-19

Affected packages

• Packagist orchid/platform: >= 9.0.0, < 9.4.4 → fixed in 9.4.4

Description

Impact Inline attributes have not been processed escape. If the data that came from users was not processed, then an XSS vulnerability is possible Patches Fixed in 9.4.4

Related

Alias · CVE (1)

  • CVE-2020-15263 In platform before version 9.4.4, inline attributes are not properly escaped. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References