GitHub Advisoryadvisory · PyPI

GHSA-pwgc-w4x9-gw67 changedetection.io Cross-site Scripting vulnerability

MEDIUM Published 2024-05-03 Modified 2024-05-03 Official page ↗
Aliases
CVE-2024-34061
Ecosystem
PyPI
Packages
changedetection.io
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-03

Affected packages

• PyPI changedetection.io: < 0.45.22 → fixed in 0.45.22

Description

Summary Input in parameter notification_urls is not processed resulting in javascript execution in the application Details changedetection.io version: v0.45.21 https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226 ``` for server_url in field.data: if not apobj.add(server_url): message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url)) raise ValidationError(message) ``` PoC Setting > ADD Notification URL List ``` "> ``` Requests Impact A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content

Related

Alias · CVE (1)

  • CVE-2024-34061 changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References