GitHub Advisoryadvisory · PyPI

GHSA-5v6q-xqq8-g4xj Roundup Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-17 Modified 2025-04-13 Official page ↗
Aliases
CVE-2012-6132
Ecosystem
PyPI
Packages
roundup
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2024-04-30

Affected packages

• PyPI roundup: < 1.4.20 → fixed in 1.4.20

Description

Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter.

Related

Alias · CVE (1)

  • CVE-2012-6132 Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References