Cross-site Scripting in OpenCRX
Moderate severity
GitHub Reviewed
Published
Sep 30, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
>= 4.0.0, < 5.2.0
Patched versions
5.2.0
Description
Published by the National Vulnerability Database
Sep 29, 2021
Reviewed
Sep 30, 2021
Published to the GitHub Advisory Database
Sep 30, 2021
Last updated
Feb 1, 2023
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
References