Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:41224
HistoryJul 12, 2023 - 9:34 a.m.

Cross-Site Scripting (XSS)

2023-07-1209:34:22
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
cross-site scripting
github repository
vulnerable
special characters
front end
attacker
malicious javascript
payload
comment parameter
article function
software

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

51.9%

github.com/mlogclub/bbs-go is vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim’s browser via a crafted payload to the comment parameter in the article function…

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.002 Low

EPSS

Percentile

51.9%

Related for VERACODE:41224