CVE-2020-36828

    Dashboard / Vulnerabilities / CVE-2020-36828

    CVE-2020-36828

    Published: 31 Mar 2024Last Modified: 8 Jul 2026

    Summary:

    Details: A vulnerability was found in DiscuzX up to 3.4-20200818. It has been classified as problematic. Affected is the function show_next_step of the file upload/install/include/install_function.php. The manipulation of the argument uchidden leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.4-20210119 is able to address this issue. The name of the patch is 4a9673624f46f7609486778ded9653733020c567. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258612.

    References: https://vuldb.com/?ctiid.258612, https://vuldb.com/?id.258612, https://github.com/codersclub/DiscuzX/commit/4a9673624f46f7609486778ded9653733020c567

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4a9673624f46f7609486778ded9653733020c567

    Affected versions

    v3.4-20191201

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-36828 | CVE-DB