GitHub Advisoryadvisory · PyPI
GHSA-xmw7-848p-p95w Airbnb Knowledge Repo XSS In Comments
MEDIUM
Official page ↗
- Aliases
- CVE-2018-12104
- Ecosystem
- PyPI
- Packages
- knowledge-repo
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-04-22
Affected packages
• PyPI knowledge-repo: < 0.9.0 → fixed in 0.9.0
Description
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo prior to 0.9.0 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the `post/posts/new_report.kp` URI.
Related
Alias · CVE (1)
- CVE-2018-12104 Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-12104 advisory
- https://github.com/airbnb/knowledge-repo/issues/254 web
- https://github.com/airbnb/knowledge-repo/issues/431 web
- https://github.com/airbnb/knowledge-repo/pull/558 web
- https://github.com/airbnb/knowledge-repo/commit/f026ad2afea14e0ffc91f1aa0eaedcdc72c63167 web
- https://github.com/airbnb/knowledge-repo package
- https://github.com/pypa/advisory-database/tree/main/vulns/knowledge-repo/PYSEC-2018-116.yaml web
- https://pypi.org/project/knowledge-repo web
- https://web.archive.org/web/20200227121013/http://www.securityfocus.com/bid/104487 web