What is GHSA-927p-xrc2-x2gj?

GHSA-927p-xrc2-x2gj is a security advisory published by GitHub Security Advisories with High severity. ansibleguy-webui Cross-site Scripting vulnerability

Which CVE IDs does GHSA-927p-xrc2-x2gj cover?

GHSA-927p-xrc2-x2gj covers the following CVE IDs: CVE-2024-36110. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-927p-xrc2-x2gj?

GHSA-927p-xrc2-x2gj has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-927p-xrc2-x2gj?

GHSA-927p-xrc2-x2gj affects 1 product, including: pip/ansibleguy-webui:\u003c 0.0.21.

GHSA-927p-xrc2-x2gjHighCVSS 8.2

ansibleguy-webui Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

May 28, 2024

Last Modified

June 3, 2024

🔗 CVE IDs covered (1)

CVE-2024-36110 →

📋 Description

Impact

Multiple forms in version <0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser.

Patches

We recommend to upgrade to version >= 0.0.21

References

Report
GitHub Issue 44

🎯 Affected products1

pip/ansibleguy-webui:< 0.0.21

🔗 References (6)

https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522
https://github.com/ansibleguy/webui/files/15358522/Report.pdf
https://nvd.nist.gov/vuln/detail/CVE-2024-36110
https://github.com/ansibleguy/webui/issues/44
https://github.com/advisories/GHSA-927p-xrc2-x2gj