GitHub Advisoryadvisory · Packagist

GHSA-g688-7j3c-h9f3 Known v1.3.1 Cross-site Scripting

MEDIUM Published 2022-07-09 Modified 2022-07-20 Official page ↗
Aliases
CVE-2022-31290
Ecosystem
Packagist
Packages
idno/known
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-20

Affected packages

• Packagist idno/known: <= 1.3.1 (no fix yet)

Description

A cross-site scripting (XSS) vulnerability in Known v1.3.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

Related

Alias · CVE (1)

  • CVE-2022-31290 A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References