Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS05MjdwLXhyYzIteDJnas4AA8jJ

ansibleguy-webui Cross-site Scripting vulnerability

Impact

Multiple forms in version <0.0.21 allowed injection of HTML elements.
These are returned to the user after executing job actions and thus evaluated by the browser.

Patches

We recommend to upgrade to version >= 0.0.21

References

Permalink: https://github.com/advisories/GHSA-927p-xrc2-x2gj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05MjdwLXhyYzIteDJnas4AA8jJ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 7 months ago
Updated: 6 months ago


CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

EPSS Percentage: 0.00045
EPSS Percentile: 0.16558

Identifiers: GHSA-927p-xrc2-x2gj, CVE-2024-36110
References: Repository: https://github.com/ansibleguy/webui
Blast Radius: 1.0

Affected Packages

pypi:ansibleguy-webui
Dependent packages: 0
Dependent repositories: 0
Downloads: 1,286 last month
Affected Version Ranges: < 0.0.21
Fixed in: 0.0.21
All affected versions: 0.0.12, 0.0.13, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20
All unaffected versions: 0.0.23, 0.0.24