Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1maDVjLTdnbWcteG1wNs4AAQeh

Kallithea cross-site scripting (XSS) vulnerability

Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description.

Permalink: https://github.com/advisories/GHSA-fh5c-7gmg-xmp6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1maDVjLTdnbWcteG1wNs4AAQeh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 20 days ago

CVSS Score: 5.4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-fh5c-7gmg-xmp6, CVE-2015-1864
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-1864
• https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55
• https://kallithea-scm.org/security/cve-2015-1864.html
• http://www.openwall.com/lists/oss-security/2015/04/14/12
• https://web.archive.org/web/20200228161446/http://www.securityfocus.com/bid/74184
• https://github.com/advisories/GHSA-fh5c-7gmg-xmp6

Blast Radius: 4.2

Affected Packages