Lucene search

Veracode Vulnerability DatabaseVERACODE:41224

HistoryJul 12, 2023 - 9:34 a.m.

Cross-Site Scripting (XSS)

2023-07-1209:34:22

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

github repository

vulnerable

special characters

front end

attacker

malicious javascript

payload

comment parameter

article function

software

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

69.9%

JSON

github.com/mlogclub/bbs-go is vulnerable to Cross-Site Scripting (XSS) attacks. The library does not properly escape the special characters before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim’s browser via a crafted payload to the comment parameter in the article function…

References

bbs-go.com

github.com/advisories/GHSA-p356-h5pr-gp95

github.com/cuiyan142857/bbs-go/commit/024b7e06fc6f73d5ec51825b773e38ee55274496

github.com/mlogclub/bbs-go

github.com/mlogclub/bbs-go/issues/206

github.com/mlogclub/bbs-go/pull/207