CVE-2020-27388: YOURLS Stored Cross Site Scripting (XSS)
Summary
CVE-2020-27388: YOURLS Stored Cross Site Scripting (XSS). Affects yourls/yourls versions >= 1.5, < 1.8. Fixed in 1.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YOURLS is an open-source URL shortener written in PHP. It allows users to create and manage their own URL shortening service. YOURLS Admin Panel is a component of YOURLS that provides an interface for administrators to manage the URL shortening service. The vulnerability affects YOURLS Admin Panel versions 1.5 to 1.7.10.
Vulnerability Detail
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel. These vulnerabilities can be exploited by an authenticated user who modifies a PHP plugin with a malicious payload and uploads it. This results in multiple stored XSS issues. The impact of these vulnerabilities can range from unauthorized access to sensitive information to the execution of arbitrary code in the context of the affected user's browser.
How To Fix
Minimum fixed version
1.8
This is the first release that contains the fix.
composer require yourls/yourls:1.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of YOURLS Admin Panel.
Conclusion
The YOURLS Admin Panel is vulnerable to multiple stored XSS vulnerabilities. To mitigate the risk, it is crucial to upgrade to the latest version of YOURLS Admin Panel. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yourls/yourls →
FAQ
YOURLS is an open-source URL shortener written in PHP. It allows users to create and manage their own URL shortening service.
The YOURLS Admin Panel is a component of YOURLS that provides an interface for administrators to manage the URL shortening service.
Versions 1.5 to 1.7.10 of YOURLS Admin Panel are affected by this vulnerability.
The impact of the vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code in the context of the affected user's browser.
To fix the vulnerability, it is recommended to upgrade to YOURLS Admin Panel version 1.8 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for yourls/yourls.
