GitHub Advisoryadvisory · PyPI

GHSA-qjmg-77xh-7mjw Loggerhead XSS via filename

LOW Published 2022-05-17 Modified 2024-01-15 Official page ↗
Aliases
CVE-2011-0728
Ecosystem
PyPI
Packages
loggerhead
Severity
Low
Weaknesses
CWE-79
Reviewed
2024-01-15

Affected packages

• PyPI loggerhead: < 1.18.1 → fixed in 1.18.1

Description

Cross-site scripting (XSS) vulnerability in `templatefunctions.py` in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

Related

Alias · CVE (1)

  • CVE-2011-0728 Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References