CVE-2020-15253

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1

7.3 HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.25% chance of exploitation in the next 30 days, 67th percentile

Published

2020-10-14

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48792

References

• CVE Record
• NVD entry

Related

• CVE-2020-15238
• CVE-2020-15255
• CVE-2020-15228
• CVE-2020-15256
• CVE-2020-15227
• CVE-2020-15257