CVE-2019-20381

Name of the Vulnerable Software and Affected Versions TestLink versions prior to 1.9.20

Description The issue allows for XSS via non-lowercase javascript: in the reqURI parameter of index.php. This problem exists due to an incomplete fix for a previous issue.

Recommendations For versions prior to 1.9.20, update to version 1.9.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the reqURI parameter in index.php to minimize the risk of exploitation.