Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS05MjdwLXhyYzIteDJnas4AA8jJ
ansibleguy-webui Cross-site Scripting vulnerability
Impact
Multiple forms in version <0.0.21 allowed injection of HTML elements.
These are returned to the user after executing job actions and thus evaluated by the browser.
Patches
We recommend to upgrade to version >= 0.0.21
References Permalink: https://github.com/advisories/GHSA-927p-xrc2-x2gj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05MjdwLXhyYzIteDJnas4AA8jJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 7 months ago
Updated: 6 months ago
CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
EPSS Percentage: 0.00045
EPSS Percentile: 0.16558
Identifiers: GHSA-927p-xrc2-x2gj, CVE-2024-36110
References:
- https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
- https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522
- https://github.com/ansibleguy/webui/files/15358522/Report.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2024-36110
- https://github.com/ansibleguy/webui/issues/44
- https://github.com/advisories/GHSA-927p-xrc2-x2gj
Blast Radius: 1.0
Affected Packages
pypi:ansibleguy-webui
Dependent packages: 0Dependent repositories: 0
Downloads: 1,286 last month
Affected Version Ranges: < 0.0.21
Fixed in: 0.0.21
All affected versions: 0.0.12, 0.0.13, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20
All unaffected versions: 0.0.23, 0.0.24