Medium severity6.1NVD Advisory· Published Aug 31, 2020· Updated Jun 17, 2026
CVE-2020-13655
CVE-2020-13655
Description
An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to, the file and target parameters are reflected.
Affected products
3cpe:2.3:a:o-dyn:collabtive:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:o-dyn:collabtive:*:*:*:*:*:*:*:*range: >=3.0
- (no CPE)range: >=3.0
- Collabtive/Collabtivedescription
Patches
Vulnerability mechanics
References
2- sisl.lab.uic.edu/projects/chess/cross-site-scripting-in-collabtive/nvdExploitThird Party Advisory
- www.collabtive.o-dyn.de/blog/nvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.