Description

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task.

Remediation

References

CVE-2020-26166

Related Vulnerabilities

MySQL CVE-2014-0430 Vulnerability (CVE-2014-0430)

WordPress 3.7.x Cross-Site Request Forgery (3.7 - 3.7.28)

WordPress Plugin WP-PostViews Cross-Site Request Forgery (1.62)

Atlassian Jira Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2021-39128)

WordPress Plugin Stockdio Historical Chart Cross-Site Scripting (2.7.2)

Severity

Medium

Classification

CVE-2020-26166 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities