Lucene search

GitHub Advisory DatabaseGHSA-HFXP-J95J-CWRP

HistoryMar 06, 2023 - 6:30 p.m.

uvdesk/community-skeleton vulnerable to Stored Cross-site Scripting

2023-03-0618:30:22

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

github

uvdesk/community-skeleton

vulnerable

stored

software

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

25.6%

JSON

Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.

Affected configurations

Vulners

Node

uvdeskcommunity-skeletonRange<1.1.0

VendorProductVersionCPE
uvdeskcommunity-skeleton*cpe:2.3:a:uvdesk:community-skeleton:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
uvdesk	community-skeleton	*	cpe:2.3:a:uvdesk:community-skeleton::::::::

References

github.com/advisories/GHSA-hfxp-j95j-cwrp

github.com/uvdesk/community-skeleton/commit/6fae9442361c8a216611d3622bec26249a8c48a0

huntr.dev/bounties/97d226ea-2cd8-4f4d-9360-aa46c37fdd26

nvd.nist.gov/vuln/detail/CVE-2023-1197