CVE-2020-18702

MEDIUM6.1EPSS 0.40%

Cross Site Scripting (XSS) in Quokka

發布日:2021/8/30修改日:2024/10/24

也稱為:GHSA-5m69-3chg-6f8mPYSEC-2021-143

描述

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.

受影響套件(2)

PyPI/quokkafrom 0, <= 0.4.0
PyPI/quokkafrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

參考連結(5)

ADVISORYhttps://github.com/advisories/GHSA-5m69-3chg-6f8m
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-18702
PATCHhttps://github.com/rochacbruno/quokka
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/quokka/PYSEC-2021-143.yaml
WEBhttps://github.com/rochacbruno/quokka/issues/675