CVE-2020-5677 - Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors

MEDIUM

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors

Published Dec 3, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 1.16%

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified vectors.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
WESEEK, Inc.	Growi	unknown	Affected v4.0.0 and earlier

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26838		Advisory
https://github.com/weseek/growi		x_refsource_MISCProductThird Party Advisory
https://hub.docker.com/r/weseek/growi/		x_refsource_MISCProductThird Party Advisory
https://jvn.jp/en/jp/JVN56450373/index.html		x_refsource_MISCThird Party Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner jpcert

Published Dec 3, 2020

Updated Aug 4, 2024

Reserved Jan 6, 2020

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner jpcert

Published Dec 3, 2020

Updated Aug 4, 2024

GitHub

No data