GitHub Advisoryadvisory · Packagist

GHSA-9652-78hp-w58c Stored cross-site scripting in PressBooks

MEDIUM Published 2021-03-29 Modified 2021-03-19 Official page ↗
Aliases
CVE-2021-3271
Ecosystem
Packagist
Packages
pressbooks/pressbooks
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-03-19

Affected packages

• Packagist pressbooks/pressbooks: < 5.18.0 → fixed in 5.18.0

Description

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.

Related

Alias · CVE (1)

  • CVE-2021-3271 PressBooks 5.17.3 contains a cross-site scripting (XSS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References