CVE:CVE-2020-9439
CNNVD:CNNVD-202012-1527
Uncanny Owl Tin Canny LearnDash Reporting是加拿大Uncanny Owl公司的一个为Wordpress提供学习记录存储功能的插件。
 Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4  存在安全漏洞，该漏洞源于以下脚本或参数：search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.
solution:Upgrade uncannyowl tin_canny_reporting_for_learndash to a higher version than 3.4.4,and avoid the version (,3.4.4)