CVE-2024-26318

描述

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.

受影響套件(2)

• npm/@serenity-is/corelibfrom 0, < 6.8.0
• NuGet/Serenity.Net.Corefrom 0, < 6.8.0

CVSS 分數

參考連結(3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-26318
• PATCHhttps://github.com/serenity-is/Serenity
• WEBhttps://serenity.is/docs/release-notes/6.8.0