CVE-2020-13870: 
PHP vulnerability analysis and mitigation

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue that affects the Comments plugin for Craft CMS. The vulnerability exists when handling asset volume names, which could contain potentially malicious values. The issue was assigned a CWE-79 (Improper Neutralization of Input During Web Page Generation) classification (CVE Details).

The vulnerability allows attackers to execute arbitrary code through stored XSS attacks by injecting malicious content via asset volume names. This could potentially lead to unauthorized access to user data or execution of arbitrary actions in the context of other users' sessions (Changelog).

The vulnerability requires an attacker to have access to create or modify asset volume names in the Craft CMS Comments plugin. The issue was discovered and reported by Paweł Hałdrzyński from Limpid Security (Changelog).

The vulnerability was patched in Comments plugin version 1.5.5. Users are strongly advised to upgrade to this version or later to address the security issue. The fix properly sanitizes asset volume names to prevent XSS attacks (Changelog).