CVE-2023-27494 Streamlit Cross-site Scripting vulnerability

2023-03-1620:29:17

CWE-79

GitHub_M

www.cve.org

streamlit

xss

vulnerability

web applications

reflected

attack

patch

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

EPSS

0.001

Percentile

33.1%

JSON

Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit app(s) were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to a Streamlit app. The attacker could then trick the user into visiting the malicious URL and, if successful, the server would render the malicious javascript payload as-is, leading to XSS. Version 0.81.0 contains a patch for this vulnerability.

CNA Affected

[
  {
    "vendor": "streamlit",
    "product": "streamlit",
    "versions": [
      {
        "version": ">= 0.63.0, < 0.81.0",
        "status": "affected"
      }
    ]
  }
]