CVE-2020-21517
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.
Risk Assessment
An attacker can exploit this flaw to steal user sessions, redirect to malicious sites, or perform other actions in the victim's context, compromising data confidentiality and integrity.
Recommendation
Immediately update MetInfo to the latest version that includes a fix for this vulnerability. If an update is not possible, apply filtering and validation to the gourl parameter.
Other vulnerabilities in MetInfo
See all- CVE-2017-11717High
MetInfo through versions 5.3.17 accepts the same CAPTCHA response for 120 seconds, making it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream.
- CVE-2017-11500High
In MetInfo 5.3.17, there is a directory traversal vulnerability. A remote attacker can use '..\' in the filenames parameter of /admin/system/database/filedown.php to delete any .zip file on the server.
- CVE-2017-11347High
CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.
- CVE-2017-11715Critical
In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.
- CVE-2020-20585High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
Original NVD description (English source)
Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS