GitHub Advisoryadvisory · PyPI

GHSA-9w49-m7xh-5r39 Cross-site scripting in papermerge

MEDIUM Published 2021-04-20 Modified 2024-10-09 Official page ↗
Aliases
CVE-2020-29456
Ecosystem
PyPI
Packages
papermerge
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-04-09

Affected packages

• PyPI papermerge: >= 1.2.0, < 1.5.2 → fixed in 1.5.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.

Related

Alias · CVE (1)

  • CVE-2020-29456 Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References