GitHub Advisoryadvisory · NuGet

GHSA-93h6-wx7r-mgfp Cross Site Scripting (XSS) in Serenity

MEDIUM Published 2023-04-27 Modified 2023-05-05 Official page ↗
Aliases
CVE-2023-31285
Ecosystem
NuGet
Packages
Serenity.Net.Core, Serenity.Net.Services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-04-27

Affected packages

• NuGet Serenity.Net.Core: < 6.7.0 → fixed in 6.7.0 • NuGet Serenity.Net.Services: < 6.7.0 → fixed in 6.7.0

Description

An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.

Related

Alias · CVE (1)

  • CVE-2023-31285 An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References