CVE-2020-15253
Stored XSS in Grocy
- State
- Published
- Severity
- 7.3 High
- Published
- Oct 14, 2020
- Updated
- Aug 4, 2024
- Reserved
- Jun 25, 2020
Description
Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-79 {"CWE-79":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}
Affected Products
| Product | Versions |
|---|---|
grocygrocy |
|
References
- https://www.exploit-db.com/exploits/48792
- https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7
- https://github.com/grocy/grocy/issues/996
- https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772
- https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.