GitHub Advisoryadvisory · Packagist

GHSA-2pg6-vw9c-qhjv Passbolt API allows HTML injection

MEDIUM Published 2024-04-26 Modified 2024-04-26 Official page ↗
Aliases
CVE-2024-33670
Ecosystem
Packagist
Packages
passbolt/passbolt_api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-04-26

Affected packages

• Packagist passbolt/passbolt_api: < 4.6.2 → fixed in 4.6.2

Description

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript due to Content Security Policy (CSP) restrictions, it may still impact the appearance and user interaction of the page.

Related

Alias · CVE (1)

  • CVE-2024-33670 Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References