CVE Vulnerability

CVE-2020-15253

Versions of Grocy <= 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product groups, recipes and products. Authentication is required to exploit these issues and Grocy should not be publicly exposed. The linked reference details a proof-of-concept.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/grocy/grocy/security/advisories/GHSA-7f37-2fjr-v9p7 Third Party Advisory
https://github.com/grocy/grocy/issues/996 Exploit Issue Tracking
https://github.com/grocy/grocy/commit/0df2590de27c60c18b7db6e056347bd2aff5a887 Patch Third Party Advisory
https://github.com/grocy/grocy/commit/0624b0df594a4353ef25e6b1874565ea52ce7772 Patch Third Party Advisory
https://www.exploit-db.com/exploits/48792 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:grocy:grocy:*:*:*:*:*:*:*:*
Information

Published : 2020-10-14 07:15

Updated : 2022-10-18 08:20

NVD link : CVE-2020-15253

Mitre link : CVE-2020-15253

Products Affected
No products.
CWE
CWE-79