GitHub Advisoryadvisory · Packagist

GHSA-v6g2-jwrm-h5r5 phpMyFAQ Cross-site Scripting

MEDIUM Published 2023-06-30 Modified 2023-06-30 Official page ↗
Aliases
CVE-2023-3469
Ecosystem
Packagist
Packages
thorsten/phpmyfaq
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-06-30

Affected packages

• Packagist thorsten/phpmyfaq: < 3.2.0-beta.2 → fixed in 3.2.0-beta.2

Description

phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.

Related

Alias · CVE (1)

  • CVE-2023-3469 Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.2. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References