CVE-2023-38758

MEDIUM5.4EPSS 0.10%

wger Workout Manager Cross-site Scripting vulnerability

發布日:2023/8/8修改日:2024/11/19

也稱為:GHSA-8m9p-3926-gffrPYSEC-2023-143

描述

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the `license_author `field in the add-ingredient function in the `templates/ingredients/view.html`, `models/ingredients.py`, and `views/ingredients.py` components.

受影響套件(2)

PyPI/wgerfrom 0, <= 2.2.0a3
PyPI/wgerfrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-38758
PATCHhttps://github.com/wger-project/wger
WEBhttps://github.com/0x72303074/CVE-Disclosures
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/wger/PYSEC-2023-143.yaml
WEBhttps://wger.de