Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0yY2g4LWY4NDktcGpnM84AAdMq

Eugene Pankov Ajenti Cross-site scripting Vulnerabilities

Multiple cross-site scripting (XSS) vulnerabilities in the respond_error function in routing.py in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) resources.js or (2) resources.css in ajenti:static/, related to the traceback page.

Permalink: https://github.com/advisories/GHSA-2ch8-f849-pjg3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yY2g4LWY4NDktcGpnM84AAdMq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: 3 months ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-2ch8-f849-pjg3, CVE-2014-4301
References: Repository: https://github.com/Eugeny/ajenti
Blast Radius: 1.8

Affected Packages

pypi:ajenti
Dependent packages: 0
Dependent repositories: 2
Downloads: 24,451 last month
Affected Version Ranges: < 1.2.21.7
Fixed in: 1.2.21.7
All affected versions: 0.99.7, 0.99.8, 0.99.11, 0.99.19, 0.99.20, 0.99.21, 0.99.22, 0.99.23, 0.99.24, 0.99.25, 0.99.26, 0.99.27, 0.99.28, 0.99.29, 0.99.30, 0.99.31, 0.99.32, 0.99.33, 0.99.34, 0.99.35, 0.99.36, 0.99.37, 0.99.38, 0.99.39, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.8, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.8, 1.1.9, 1.2.0, 1.2.1, 1.2.2-0.0, 1.2.2-0.1, 1.2.2-0.2, 1.2.2-0.3, 1.2.2-0.4, 1.2.2-0.5, 1.2.2-0.6, 1.2.2-0.7, 1.2.2-0.8, 1.2.2-0.9, 1.2.2-0.10, 1.2.2-1.0, 1.2.2-1.1, 1.2.2-1.2, 1.2.2-1.3, 1.2.2-1.4, 1.2.2-1.5, 1.2.2-1.6
All unaffected versions: 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18