What is GHSA-rfw2-x9f8-2f6m?

GHSA-rfw2-x9f8-2f6m is a security advisory published by GitHub Security Advisories with Medium severity. LinkedIn Oncall vulnerable to Cross-Site Scripting

Which CVE IDs does GHSA-rfw2-x9f8-2f6m cover?

GHSA-rfw2-x9f8-2f6m covers the following CVE IDs: CVE-2021-26722. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rfw2-x9f8-2f6m?

GHSA-rfw2-x9f8-2f6m has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rfw2-x9f8-2f6m?

GHSA-rfw2-x9f8-2f6m affects 1 product, including: pip/oncall:\u003c 1.4.1.

GHSA-rfw2-x9f8-2f6mMediumCVSS 6.1

LinkedIn Oncall vulnerable to Cross-Site Scripting

Vendor

GitHub Security Advisories

Published

April 30, 2021

Last Modified

October 7, 2024

🔗 CVE IDs covered (1)

CVE-2021-26722 →

📋 Description

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.

🎯 Affected products1

pip/oncall:< 1.4.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-26722
https://github.com/linkedin/oncall/issues/341
https://github.com/linkedin/oncall/commit/843bc106a1c1b1699e9e52b6b0d01c7efe1d6225
https://github.com/advisories/GHSA-rfw2-x9f8-2f6m
https://github.com/pypa/advisory-database/tree/main/vulns/oncall/PYSEC-2021-33.yaml
https://pypi.org/project/oncall