Veracode Vulnerability DatabaseVERACODE:45845Cross Site Scripting (XSS)
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%
Phlex is vulnerable to a cross-site scripting (XSS). The vulnerability is due to improper case-sensitivity checks, rendering an `` tag with a user-provided link in the href attribute within the sgml.rb file, resulting in the execution of JavaScript when clicked on by another user.
References
developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1
github.com/phlex-ruby/phlex/security/advisories/GHSA-242p-4v39-2v8g
Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.6%