GitHub Advisoryadvisory · Packagist

GHSA-79xr-v794-wq35 MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-24 Modified 2025-11-19 Official page ↗
Aliases
CVE-2020-15883
Ecosystem
Packagist
Packages
munkireport/managedinstalls
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-11-15

Affected packages

• Packagist munkireport/managedinstalls: < 2.6 → fixed in 2.6

Description

A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).

Related

Alias · CVE (1)

  • CVE-2020-15883 A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References