What is GHSA-5jq3-8437-x35p?

GHSA-5jq3-8437-x35p is a security advisory published by GitHub Security Advisories with Medium severity. Multiple cross-site scripting (XSS) vulnerabilities in Roundup

Which CVE IDs does GHSA-5jq3-8437-x35p cover?

GHSA-5jq3-8437-x35p covers the following CVE IDs: CVE-2012-6133. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5jq3-8437-x35p?

GHSA-5jq3-8437-x35p has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5jq3-8437-x35p?

GHSA-5jq3-8437-x35p affects 1 product, including: pip/roundup:\u003c 1.4.20.

GHSA-5jq3-8437-x35pMediumCVSS 6.1

Multiple cross-site scripting (XSS) vulnerabilities in Roundup

Vendor

GitHub Security Advisories

Published

April 23, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2012-6133 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.

🎯 Affected products1

pip/roundup:< 1.4.20

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2012-6133
https://bugzilla.redhat.com/show_bug.cgi?id=722672
https://pypi.python.org/pypi/roundup/1.4.20
http://issues.roundup-tracker.org/issue2550724
http://www.openwall.com/lists/oss-security/2012/11/10/2
http://www.openwall.com/lists/oss-security/2013/02/13/8
https://github.com/advisories/GHSA-5jq3-8437-x35p
https://github.com/pypa/advisory-database/tree/main/vulns/roundup/PYSEC-2020-212.yaml