Cross-Site Scripting (XSS)

2024-04-0506:56:47

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

github

vulnerability

links.html

1-click previews

html insertion

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

9.0%

JSON

github.com/alexxit/go2rtc is vulnerable for Cross-Site Scripting (XSS). The vulnerability due to the links.html page appending the src GET parameter in all of its links for 1-click previews, where the context of appending is innerHTML, leading to the insertion of the text as HTML which results in XSS.