GitHub Advisoryadvisory · Hex

GHSA-5chx-gg25-v37m Cross-site Scripting in xain

MEDIUM Published 2022-04-12 Modified 2022-04-12 Official page ↗

Aliases: CVE-2018-20302
Ecosystem: Hex
Packages: xain
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-79
Reviewed: 2022-04-12

Affected packages

• Hex xain: < 0.6.2 → fixed in 0.6.2

Description

XSS is possible via the use of the order query parameter. An example request would look like: ``` http://host/ressources?order=%27>alert(1); ```

Related

Alias · CVE (1)

CVE-2018-20302 An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References