GitHub Advisoryadvisory · npm

GHSA-f2c5-997w-7f5c Cross-site Scripting in peertube

MEDIUM Published 2021-09-20 Modified 2021-09-24 Official page ↗
Aliases
CVE-2021-3780
Ecosystem
npm
Packages
peertube
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-09-16

Affected packages

• npm peertube: < 3.4.0 → fixed in 3.4.0

Description

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.

Related

Alias · CVE (1)

  • CVE-2021-3780 peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References