CVE-2020-15883: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in the managedinstalls module before version 2.6 for MunkiReport. The vulnerability, identified as CVE-2020-15883, allows remote attackers to inject arbitrary HTML or JavaScript code. The issue was discovered and disclosed in July 2020, affecting MunkiReport versions from 2.5.3 to 5.6.2 (NVD, MunkiReport Wiki).

The vulnerability is a reflected cross-site scripting (XSS) issue that exists due to insufficient escaping of dangerous characters from the URL while building the page. The application fails to properly sanitize user input in the managedinstalls module, which could allow client-side code execution when users click on malicious links from the trusted application (MunkiReport Wiki).

This vulnerability could allow attackers to execute arbitrary JavaScript code in the context of the user's browser session when they click a malicious link from the trusted application. This could potentially lead to unauthorized access to user data, session hijacking, or other malicious actions within the context of the authenticated user (MunkiReport Wiki).

The vulnerability requires an authenticated user to click on a specially crafted malicious link. The issue was discovered by the Datadog security team, specifically by Edouard Schweisguth (MunkiReport Release).

Users are advised to update to the latest version of MunkiReport. If updating to the latest version is not possible, there are two alternative mitigations: 1) Update the managedinstalls module to v2.6, or 2) Disable the managedinstalls module by removing it from the MODULES= setting in the server config (MunkiReport Wiki).