CVE-2021-3427

MEDIUM6.1EPSS 0.63%

Deluge Web-UI vulnerable to XSS through a crafted torrent file

發布日:2022/8/27修改日:2024/9/16

也稱為:GHSA-5c8p-qhch-qhx6PYSEC-2022-256

描述

The Deluge Web-UI is vulnerable to cross-site scripting through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.

受影響套件(3)

Debian/delugefrom 0
PyPI/delugefrom 0, < 2.1.0
PyPI/delugefrom 0, < 2.1.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

參考連結(8)

ADVISORYhttps://github.com/advisories/GHSA-5c8p-qhch-qhx6
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-3427
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-3427
PATCHhttps://github.com/deluge-torrent/deluge
WEBhttps://dev.deluge-torrent.org/ticket/3459
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/deluge/PYSEC-2022-256.yaml
WEBhttps://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
WEBhttps://security.gentoo.org/glsa/202210-07