Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA
UnoPim Cross-site Scripting vulnerability
UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.
The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.
Permalink: https://github.com/advisories/GHSA-hv6m-qj65-26q3JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Percentage: 0.00045
EPSS Percentile: 0.16725
Identifiers: GHSA-hv6m-qj65-26q3, CVE-2024-50637
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-50637
- https://github.com/unopim/unopim/issues/41
- https://github.com/unopim/unopim/releases/tag/v0.1.4
- https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md
- https://github.com/advisories/GHSA-hv6m-qj65-26q3
Blast Radius: 1.0
Affected Packages
packagist:unopim/unopim
Dependent packages: 0Dependent repositories: 0
Downloads: 383 total
Affected Version Ranges: < 0.1.4
Fixed in: 0.1.4
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3
All unaffected versions: 0.1.4, 0.1.5, 0.1.6