Lucene search

GitHub Advisory DatabaseGHSA-PJX4-3F3P-29V3

HistoryJan 05, 2023 - 9:30 a.m.

django-ucamlookup Cross-site Scripting vulnerability

2023-01-0509:30:27

CWE-79

GitHub Advisory Database

github.com

university of cambridge

lookup handler

cross site scripting

remote attack

upgrade

patch

5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3

vdb-217441

unsupported software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.3%

JSON

A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 can address this issue. The name of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected configurations

Vulners

Node

django-ucamlookup_projectdjango-ucamlookupRange<1.9.2

VendorProductVersionCPE
django-ucamlookup_projectdjango-ucamlookup*cpe:2.3:a:django-ucamlookup_project:django-ucamlookup:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
django-ucamlookup_project	django-ucamlookup	*	cpe:2.3:a:django-ucamlookup_project:django-ucamlookup::::::::

References

github.com/advisories/GHSA-pjx4-3f3p-29v3

github.com/pypa/advisory-database/tree/main/vulns/django-ucamlookup/PYSEC-2023-14.yaml

github.com/uisautomation/django-ucamlookup/commit/5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3

github.com/uisautomation/django-ucamlookup/releases/tag/1.9.2

nvd.nist.gov/vuln/detail/CVE-2016-15010

vuldb.com/?ctiid.217441

vuldb.com/?id.217441

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.3%

JSON

Related for GHSA-PJX4-3F3P-29V3