Cross-site Scripting in Serenity · CVE-2024-26318 · GitHub Advisory Database · GitHub

Cross-site Scripting in Serenity

Moderate severity GitHub Reviewed Published Feb 19, 2024 to the GitHub Advisory Database • Updated Feb 20, 2024

Package

@serenity-is/corelib (npm)

Affected versions

< 6.8.0

Patched versions

6.8.0

Serenity.Net.Core (NuGet)

< 6.8.0

6.8.0

Description

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.

References

Published by the National Vulnerability Database

Feb 19, 2024

Published to the GitHub Advisory Database Feb 19, 2024

Reviewed Feb 20, 2024

Last updated Feb 20, 2024