netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-7j9h-ch38-474r

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-26 18:24:31 +00:00
parent a757a503dd
commit 3c29bb8a26
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/12/GHSA-7j9h-ch38-474r/GHSA-7j9h-ch38-474r.json
+8 -3
View File
@@ -1,13 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7j9h-ch38-474r",
"modified": "2023-12-29T19:28:58Z",
"modified": "2024-08-26T18:23:27Z",
"published": "2023-12-21T15:30:33Z",
"withdrawn": "2024-08-26T18:23:27Z",
"aliases": [
"CVE-2023-7035"
],
"summary": "Stored Cross-site scripting affecting automad/automad",
"details": "automad up to 1.10.9 is vulnerable to stored cross-site scripting in the `sitename` argument because the `SharedController` class that handles form data and saving shared information does not properly sanitize the user input on the client side when rendering the data. The attack may be launched remotely and an exploit has been disclosed publicly.",
"summary": "Withdrawn Advisory: Stored Cross-site scripting affecting automad/automad",
"details": "## Withdrawn Advisory\nThis advisory has been withdrawn because only the main admin with the highest level of privilege can provide input, and there are no users other than the admin from whom data could be stolen. This link is maintained to preserve external references.\n\n## Original Description\nautomad up to 1.10.9 is vulnerable to stored cross-site scripting in the `sitename` argument because the `SharedController` class that handles form data and saving shared information does not properly sanitize the user input on the client side when rendering the data. The attack may be launched remotely and an exploit has been disclosed publicly.",
"severity": [
{
"type": "CVSS_V3",
@@ -44,6 +45,10 @@
"type": "PACKAGE",
"url": "https://github.com/marcantondahmen/automad"
},
{
"type": "WEB",
"url": "https://github.com/marcantondahmen/automad/blob/v2/SECURITY.md"
},
{
"type": "WEB",
"url": "https://github.com/screetsec/VDD/tree/main/Automad%20CMS/Stored%20Cross%20Site%20Scripting%20(XSS)"